Splunk Search

User agent string using lookup table

jaibalaraman
Path Finder

Hi Team 

I am trying to extract the OS details from the user agent using the below eval command, however I am not able to see new filed was created (test) after i executed the spl query

index=aws Website="*"
| eval test = case(match(useragent,"Windows .. 5\.1"),"Windows XP",match(useragent,"droid"),"Android",match(useragent,"Windows NT 6.1"),"Windows 7")

Any help please

 

Thank s

Labels (1)
Tags (1)
0 Karma

jaibalaraman
Path Finder

Hi richgalloway 

Thanks for your message

Yes, i tried executing's the SPL command found no error however i am not getting any statistics result 

jaibalaraman_0-1620706992534.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The query you ran does not have a command that generates statistics so you won't see anything in the Statistics tab.  Look at the results in the Events tab or add commands to the given query.  It was not meant to be complete - just to answer the question asked.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The case function will return null if none of the expressions are true.  That's why it's a good practice to include as the last expression something that will always evaluate to true (similar to the 'default' case in HLLs).

 

index=aws Website="*"
| eval test = case(match(useragent,"Windows .. 5\.1"),"Windows XP",match(useragent,"droid"),"Android",match(useragent,"Windows NT 6\.1"),"Windows 7", 1==1, "Unknown")

If the field is set to the default value then you know none of the other cases matched and you need to re-evaluate your code.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...