Narrowing and Generalizing Searches

[monicato]

Hi!

Is it possible to narrow down this search so that it would group these results by "Interface" and "Mozilla" versus the results I provided below? I want to group all the results into more generalized groups for a simpler dashboard panel.

All these results are in the same field called "user_agent", but I would like to narrow down this search. Anyone know how this could be done? I was thinking of searching for just by keywords? Because most of my results are either "Interface...blah blah" or other... blah blah.

example results

1   "Interface (aaaf4b;win;1.8.3.3;Win7)"       
2   "Interface (aa0b;win;1.8.3.3;WinXP)"    
3   "Interface (aa04b;win;1.8.3.3;Vista)        
4   "Interface (8e0a;mac;1.8.3.3;OS X 10.6.8)"   
5   "Interface (8ea;mac;1.8.3.3;OS X 10.7.4)"      
6   "Interface (8ec0a;mac;1.8.3.3;OS X 10.7.3)"  
7   "Interface (aa04b;win;1.8.3.3;unknown)"    
8   "Interface (8e0a;mac;1.8.3.3;OS X 10.5.8)"  
9   "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WW64; Trident/5.0;CC2;   
10  "Interface" 1124    0.234167   
11  "Interface (8ec0a;mac;1.8.3.3;OS X 10.7.0)"  
12  "Mozilla/4.0 (compatible; MIE 6.0; Windows NT 5.1; V1; 
13  "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident   
14  "Interface (8ece0a;mac;1.8.3.3;OS X 10.6.3)  
15  "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0;   
16  "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)"

[Gilberto_Castil]

Hi there,

From the context you provide it seems this may be IIS data. If I get your meaning correctly, you should extract the piece of data require and then use that data in the statistical calculation. For example, when performing a search in line, you could use the following:

sourcetype=iis blah blah | rex field=user_agent "(?<field_name>\w+)\s" | stats count by field_name

Of course you can automate this in props.conf so the extraction happens automatically.

I hope this helps.