It depends on what your events look like and where they are coming from.
Depending on the source of the events you could run a custom script that adds a "mobile" tag to each event before it gets indexed by splunk.
Alternatively if there is a field which already distinguishes "mobile" from "non-mobile" (such as OS or browser) then you can simply use an "eval" to create a new field for "mobile".
... View more
