All Apps and Add-ons

not seeing additional fields when using the browscap TA.

pmccomb
Explorer

Not sure why -> everything looks installed correctly but I am not seeing the additional fields when running this search -> sourcetype = "iisw3c" | lookup browscap_lookup http_user_agent

We are running Splunk version 5.x -> could it be a version issue?

Tags (1)
0 Karma
1 Solution

jsie_splunk
Splunk Employee
Splunk Employee

Two things to check:

Did you download the .csv file per the README at etc/apps/TA-browscap?

Assuming you did, the next question is does the http_user_agent field exist in event? if not, try running the search like this instead:

sourcetype="iisw3c" | eval http_user_agent=USERAGENT | lookup browscap_lookup http_user_agent

replacing USERAGENT with the correct field name containing the raw user agent string.

View solution in original post

jsie_splunk
Splunk Employee
Splunk Employee

Two things to check:

Did you download the .csv file per the README at etc/apps/TA-browscap?

Assuming you did, the next question is does the http_user_agent field exist in event? if not, try running the search like this instead:

sourcetype="iisw3c" | eval http_user_agent=USERAGENT | lookup browscap_lookup http_user_agent

replacing USERAGENT with the correct field name containing the raw user agent string.

piebob
Splunk Employee
Splunk Employee

pmccomb, if this answer solved your problem, please mark it as 'accepted' by checking the checkbox. thanks!

0 Karma

pmccomb
Explorer

Thank you. Check #2 did the trick. Thanks again for the help.

lukejadamec
Super Champion

It could be a case sensitive issue. Lookups are case sensitive unless configured otherwise.

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...