Splunk Search

creating an 'other' field with eval

tomlongfield
Engager

I am quite knew to this and not remotely wedded to eval as the solution for this problem, I am eager to know if there is a better way to do this.

I am currently using this query:

index=cpdata | eval ua = case(
    match(userAgent, "MSIE"), "Windows",
    match(userAgent, "Windows"), "Windows",
    match(userAgent, "Android"), "Android",
    match(userAgent, "BlackBerry"), "BlackBerry",
    match(userAgent, "like Mac OS X"), "iOS"
) | chart count by ua | sort by count | reverse

Which is successfully giving me what I expect to see.. I want to create a further case of 'Other' where anything that doesn't match is counted though. I have not managed to do this.

Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Try this - one always equals one so it'll always be true...

 index=cpdata | eval ua = case(
     match(userAgent, "MSIE"), "Windows",
     match(userAgent, "Windows"), "Windows",
     match(userAgent, "Android"), "Android",
     match(userAgent, "BlackBerry"), "BlackBerry",
     match(userAgent, "like Mac OS X"), "iOS",
     1==1, "Other"
 ) | chart count by ua | sort by count | reverse

View solution in original post

Richfez
SplunkTrust
SplunkTrust

Try this - one always equals one so it'll always be true...

 index=cpdata | eval ua = case(
     match(userAgent, "MSIE"), "Windows",
     match(userAgent, "Windows"), "Windows",
     match(userAgent, "Android"), "Android",
     match(userAgent, "BlackBerry"), "BlackBerry",
     match(userAgent, "like Mac OS X"), "iOS",
     1==1, "Other"
 ) | chart count by ua | sort by count | reverse

tomlongfield
Engager

Works perfectly, thank you.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...