a bit late here but- there is a pretty simple fix for this. You need to edit the event type for ua-browser-safari so that it looks like the following: (useragent="* Safari/*" AND useragent!="* Chrome/*") OR (useragent="Safari/*" AND useragent!="* Chrome/*") OR (useragent="*+Safari/*" AND useragent!="*+Chrome/*") you can then create a new one called ua-browser-chrome whick looks like: useragent="* Chrome/*" OR useragent="*+Chrome*" hope this helps anyone else who searches and finds this answer ... View more

If you're copying/pasting the search I posted and answer for back in 2011 then the HTML chars in the regex are breaking it (dont know why those are there)... but also note there are addons and custom commands people have developed since there that are a bit more detailed/flexible than this post was... If you want to use this search then it should be like this: index=access_logs | fields + user_agent | rex field=user_agent "((?<browser_ff>Firefox\S+)|(?<browser_ie>MSIE [\d\.]+)|(?<browser_opera>Opera)|(?<browser_chrome>Chrome)|(?<browser_safari>Safari)|(?<browser_java>Java\S+)|(?<browser_nagios>nagios\S+)|(?<browser_nessus>[Nn][Ee][Ss][Ss][Uu][Ss])|(?<browser_apache>Apache\S+))" | eval browser_none=if(user_agent=="-","None","") | fillnull value="" browser_ff browser_ie browser_chrome browser_safari browser_opera browser_java browser_nagios browser_nessus broswer_none browser_apache | eval browser = browser_ff.browser_ie.browser_chrome.browser_safari.browser_opera.browser_java.browser_nagios.browser_nessus.browser_none.browser_apache | top 50 browser ... View more