Splunk Search

User agent Android 10 & IOS 14 - Difficult in extracting Field

advidlan
Loves-to-Learn

Hi 

I am trying to extract field from the user agent details like ( Operating system, Software, Software version, Software type, Os version, Hardware type) 

However i am finding some difficulty extracting the field . For example Operation system in Android, IOS & desktop are in the different field which highlighted below. 

Android user Mozilla/5.0 (LinuxAndroid 10SAMSUNG SM-T590AppleWebKit/537.36 (KHTMLlike GeckoSamsungBrowser / 12.1 Chrome/79.0.3945.136 Safari/537.36

 
 

Iphone user Mozilla/5.0 (iPhoneCPU iPhone OS 14_1 like Mac OS XAppleWebKit/605.1.15 (KHTMLlike GeckoVersion/14.0 Mobile/15E148 Safari/604.1

can someone help me how do extract field from the above user agent 

Software, Software version, Hardware type, Operation System,  Operating system name , Operation system version. 

Thanks 

View more huy dung service : thay pin iPhone 8 Plus - và dịch vụ ép kính iPhone lấy liền

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @advidlan,

the hints of @ITWhisperer guide you to the best approach to the problem.

This is a sample of this approach:

| rex "(Linux;|iPhone;\s+CPU\s+iPhone)\s+(?<os_versione>\w+\s+\w+)"

that you can test at https://regex101.com/r/km2EXB/1

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

User agent is not well defined - you could try looking at other posts on the subject, for example https://community.splunk.com/t5/Knowledge-Management/REX-command-issue-for-Multiple-user-agent/m-p/5...

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...