User agent string using lookup table

[jaibalaraman]

Hi Team 

I am trying to extract the OS details from the user agent using the below eval command, however I am not able to see new filed was created (test) after i executed the spl query

index=aws Website="*"
| eval test = case(match(useragent,"Windows .. 5\.1"),"Windows XP",match(useragent,"droid"),"Android",match(useragent,"Windows NT 6.1"),"Windows 7")

Any help please

Thank s

[jaibalaraman]

Hi richgalloway 

Thanks for your message

Yes, i tried executing's the SPL command found no error however i am not getting any statistics result 

[richgalloway]

The query you ran does not have a command that generates statistics so you won't see anything in the Statistics tab.  Look at the results in the Events tab or add commands to the given query.  It was not meant to be complete - just to answer the question asked.

[richgalloway]

The case function will return null if none of the expressions are true.  That's why it's a good practice to include as the last expression something that will always evaluate to true (similar to the 'default' case in HLLs).

index=aws Website="*"
| eval test = case(match(useragent,"Windows .. 5\.1"),"Windows XP",match(useragent,"droid"),"Android",match(useragent,"Windows NT 6\.1"),"Windows 7", 1==1, "Unknown")

If the field is set to the default value then you know none of the other cases matched and you need to re-evaluate your code.