I would like to setup a dashboard that tracks the totals for user agents in incoming requests. I couldn't find a "user agent", "user-agents" or any other field listed. When I exported the search results to CSV, I saw the following heading:
"_raw","_time",cloudaccount,host,index,linecount,message,source,sourcetype,"splunk_server"
It appears that the info containing the user agent is contained in the message field, enclosed in double double-quotes.
I assume that in order to count each type of user agent, I first need to isolate these values, then count them. What's the best way to do that?
... View more