All Apps and Add-ons

not seeing additional fields when using the browscap TA.

pmccomb
Explorer

Not sure why -> everything looks installed correctly but I am not seeing the additional fields when running this search -> sourcetype = "iisw3c" | lookup browscap_lookup http_user_agent

We are running Splunk version 5.x -> could it be a version issue?

Tags (1)
0 Karma
1 Solution

jsie_splunk
Splunk Employee
Splunk Employee

Two things to check:

Did you download the .csv file per the README at etc/apps/TA-browscap?

Assuming you did, the next question is does the http_user_agent field exist in event? if not, try running the search like this instead:

sourcetype="iisw3c" | eval http_user_agent=USERAGENT | lookup browscap_lookup http_user_agent

replacing USERAGENT with the correct field name containing the raw user agent string.

View solution in original post

jsie_splunk
Splunk Employee
Splunk Employee

Two things to check:

Did you download the .csv file per the README at etc/apps/TA-browscap?

Assuming you did, the next question is does the http_user_agent field exist in event? if not, try running the search like this instead:

sourcetype="iisw3c" | eval http_user_agent=USERAGENT | lookup browscap_lookup http_user_agent

replacing USERAGENT with the correct field name containing the raw user agent string.

piebob
Splunk Employee
Splunk Employee

pmccomb, if this answer solved your problem, please mark it as 'accepted' by checking the checkbox. thanks!

0 Karma

pmccomb
Explorer

Thank you. Check #2 did the trick. Thanks again for the help.

lukejadamec
Super Champion

It could be a case sensitive issue. Lookups are case sensitive unless configured otherwise.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...