Splunk Search

Extract browser type and device from User agent

shashank_24
Path Finder

Hi, I've been reading number of posts about how to extract the OS and browser details but I don't think there is a better or clean way to do this.

I've a similar requirement where in my logs there is a user agent field. Now what I want is to know the browser details along with device like if it's a desktop, mobile etc.

Just posting this to see if anyone has figured out anything on this which can save time writing complex SPLs?

Any help will be appreciated. 

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's an app for that.  Check out TA -user-agents at https://splunkbase.splunk.com/app/1843/#/details

---
If this reply helps you, an upvote would be appreciated.

shashank_24
Path Finder

Hi @richgalloway Thanks for the response. How does this app work? Does it create any extra field in the event?

And is it only compatible with certain format of the events. We have audit logs from ping federate which contains a field called useragent.

Just trying to understand even if i get this app installed, what is the way to extract the required information?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry, but I don't have any details about the TA.  Why not download it to your test system and try it out?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

shashank_24
Path Finder

@richgalloway yeah. I will need to speak to my Admin for that. Apart from this is there any other way to do this?

For example, extract the information by writing in SPL. I've done something like this but not sure if it is 100% correct -

| eval device = case((useragent LIKE "%Mobile%" OR useragent LIKE "%Mobile%Safari%" OR useragent LIKE "%iPhone%" OR useragent LIKE "Android%Firefox%" OR useragent LIKE "%UCBrowser%" OR useragent LIKE "%IEMobile%" OR useragent LIKE "%Dalvik%Android%" OR useragent LIKE "%Android-STV100%" ), "Mobile Device", useragent LIKE "%Windows NT%", "Windows", useragent LIKE "%Macintosh%", "Macintosh", (useragent LIKE "%Ubuntu%Linux%" OR useragent LIKE "%X11%OpenVAS%"), "Linux", true() ,"others")

| eval browser = case(match(useragent,"Firefox"),"FireFox", match(useragent,"Chrome") AND NOT match(useragent,"Edge"),"Chrome", match(useragent,"Safari") AND NOT match(useragent,"Chrome"),"Safari", match(useragent, "MSIE|Trident|Edge"), "IE", NOT match(useragent, "Chrome|Firefox|Safari|MSIE|Trident|Edge"), "OTHERS")

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have the general idea, however like is a function (used the same way as match) rather than an operator.

| eval device = case((like(useragent, "%Mobile%") OR like(useragent, "%Mobile%Safari%") OR like(useragent, "%iPhone%") OR like(useragent, "Android%Firefox%") OR like(useragent, "%UCBrowser%") OR like(useragent, "%IEMobile%") OR like(useragent, "%Dalvik%Android%") OR like(useragent, "%Android-STV100%") ), "Mobile Device", like(useragent, "%Windows NT%"), "Windows", like(useragent, "%Macintosh%"), "Macintosh", (like(useragent, "%Ubuntu%Linux%") OR like(useragent, "%X11%OpenVAS%")), "Linux", true() ,"others")
---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>