You could do something like this. I'm using a static list of all possible browser in the eval-case command. If your base browser name follows some pattern, you could extract that and assign category. index=sccm sourcetype=SSCM_BROWSER_DEFAULT | stats count by BrowserProgId00 | eval Browser=case(match(BrowserProgId00,"Chrome","Chrome", match(BrowserProgId00,"Firefox","Firefox", match(BrowserProgId00,"Safari","Safari", ....add more browser values per your data..., true(),"Unknown") | stats sum(count) as count by Browser ... View more

I feel the above code is bit clunky (or overuse/abuse of FIELDALIAS). To keep it simple and future debug friendly, it is better to write in multiple lines FIELDALIAS-dest1 = dst AS dest_ip dstport AS dest_port dstportname AS app dstif AS dest_interface address AS dest FIELDALIAS-src1 = srcport as src_port srcif AS src_interface FIELDALIAS-flow1 = ipproto AS transport sent AS bytes_out rcvd AS bytes_in FIELDALIAS-payload1 = ruleid AS rule op AS http_method arg AS uri_query FIELDALIAS-others1 = result AS status action AS vendor_action cat_site AS category I would even write it in individual lines, to make it easier to debug/automate in future ... View more

Hi, We asked the support, the only solution was a downgrade for us. ... View more

Thanks for the quick reply. My Email is -> zauberpferd12@gmail.com Thanks again. Mat ... View more