@richgalloway yeah. I will need to speak to my Admin for that. Apart from this is there any other way to do this? For example, extract the information by writing in SPL. I've done something like this but not sure if it is 100% correct - | eval device = case((useragent LIKE "%Mobile%" OR useragent LIKE "%Mobile%Safari%" OR useragent LIKE "%iPhone%" OR useragent LIKE "Android%Firefox%" OR useragent LIKE "%UCBrowser%" OR useragent LIKE "%IEMobile%" OR useragent LIKE "%Dalvik%Android%" OR useragent LIKE "%Android-STV100%" ), "Mobile Device", useragent LIKE "%Windows NT%", "Windows", useragent LIKE "%Macintosh%", "Macintosh", (useragent LIKE "%Ubuntu%Linux%" OR useragent LIKE "%X11%OpenVAS%"), "Linux", true() ,"others")
| eval browser = case(match(useragent,"Firefox"),"FireFox", match(useragent,"Chrome") AND NOT match(useragent,"Edge"),"Chrome", match(useragent,"Safari") AND NOT match(useragent,"Chrome"),"Safari", match(useragent, "MSIE|Trident|Edge"), "IE", NOT match(useragent, "Chrome|Firefox|Safari|MSIE|Trident|Edge"), "OTHERS")
... View more