Splunk Search

User agent string using lookup table

jaibalaraman
Path Finder

Hi Team 

I am trying to extract the OS details from the user agent using the below eval command, however I am not able to see new filed was created (test) after i executed the spl query

index=aws Website="*"
| eval test = case(match(useragent,"Windows .. 5\.1"),"Windows XP",match(useragent,"droid"),"Android",match(useragent,"Windows NT 6.1"),"Windows 7")

Any help please

 

Thank s

Labels (1)
Tags (1)
0 Karma

jaibalaraman
Path Finder

Hi richgalloway 

Thanks for your message

Yes, i tried executing's the SPL command found no error however i am not getting any statistics result 

jaibalaraman_0-1620706992534.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The query you ran does not have a command that generates statistics so you won't see anything in the Statistics tab.  Look at the results in the Events tab or add commands to the given query.  It was not meant to be complete - just to answer the question asked.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The case function will return null if none of the expressions are true.  That's why it's a good practice to include as the last expression something that will always evaluate to true (similar to the 'default' case in HLLs).

 

index=aws Website="*"
| eval test = case(match(useragent,"Windows .. 5\.1"),"Windows XP",match(useragent,"droid"),"Android",match(useragent,"Windows NT 6\.1"),"Windows 7", 1==1, "Unknown")

If the field is set to the default value then you know none of the other cases matched and you need to re-evaluate your code.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...