User agent Android 10 & IOS 14 - Difficult in extracting Field

[advidlan]

Hi 

I am trying to extract field from the user agent details like ( Operating system, Software, Software version, Software type, Os version, Hardware type) 

However i am finding some difficulty extracting the field . For example Operation system in Android, IOS & desktop are in the different field which highlighted below. 

Android user - Mozilla/5.0 (Linux; Android 10; SAMSUNG SM-T590) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser / 12.1 Chrome/79.0.3945.136 Safari/537.36

Iphone user - Mozilla/5.0 (iPhone; CPU iPhone OS 14_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1

can someone help me how do extract field from the above user agent 

Software, Software version, Hardware type, Operation System,  Operating system name , Operation system version. 

Thanks 

View more huy dung service : thay pin iPhone 8 Plus - và dịch vụ ép kính iPhone lấy liền

[gcusello]

Hi @advidlan,

the hints of @ITWhisperer guide you to the best approach to the problem.

This is a sample of this approach:

| rex "(Linux;|iPhone;\s+CPU\s+iPhone)\s+(?<os_versione>\w+\s+\w+)"

that you can test at https://regex101.com/r/km2EXB/1

Ciao.

Giuseppe

[ITWhisperer]

User agent is not well defined - you could try looking at other posts on the subject, for example https://community.splunk.com/t5/Knowledge-Management/REX-command-issue-for-Multiple-user-agent/m-p/5...