Is there a way to track if the useragent changes during a session from IIS logs using the transaction command?

[jwalzerpitt]

Is there a way to see if the useragent changes during a session using the transaction command?

Thx,
Jeff

[somesoni2]

Try something like this

your base search | stats values(useragent) as useragent by sessionid | where mvcount(useragent)>1

[jwalzerpitt]

Thx for the reply and search string.

Apologies for not stating earlier that I'm searching through IIS logs, which does not contain a sessionid field

[somesoni2]

Then Could you provide details on the logs that you're searching, fields available and possible some sample events?

[jwalzerpitt]

Searching against IIS logs, specifically on the fields c_ip (source IP) and cs_User_Agent.

Without a sessionID I know it's hard, but I was hoping to search for a c_ip whose cs_User_Agent changes within a specified time period, such as one minute, etc,