I have useragent string logged by our application. I am extracting OS and Browser names from these by creating event types (sample data shown below). Now when i try to chart all OS types with the following search eventtype="UserAgent" AND tag::eventtype="OperatingSystem" | chart count by eventtype| sort eventtype |rename eventtype as "OperatingSystem" I get both Browser names and Operating system names as every user agent has both browser and OS event types. Is there anyway to get only browser names or only OS? UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.3; .NET4.0C; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8) host=etc Options| sourcetype=log85 Options| source=/app/opt/tomcat/logs/user.log Options| index=main Options| date_hour=11 Options| date_mday=11 Options| eventtype=Internet Explorer Browser Options| eventtype= Trident/IE Old Browser Options| eventtype=Windows OperatingSystem Options| eventtype=UserAgent ... View more