I have useragent string logged by our application. I am extracting OS and Browser names from these by creating event types (sample data shown below).
Now when i try to chart all OS types with the following search
eventtype="UserAgent" AND tag::eventtype="OperatingSystem" | chart count by eventtype| sort eventtype |rename eventtype as "OperatingSystem"
I get both Browser names and Operating system names as every user agent has both browser and OS event types.
Is there anyway to get only browser names or only OS?
UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.3; .NET4.0C; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
host=etc Options| sourcetype=log85 Options| source=/app/opt/tomcat/logs/user.log Options| index=main Options| date_hour=11 Options| date_mday=11 Options| eventtype=Internet Explorer Browser Options| eventtype= Trident/IE Old Browser Options| eventtype=Windows OperatingSystem Options| eventtype=UserAgent
Based on your example (single) event, eventtype field should be extracted as multivalue field. You can try something like this.
eventtype="UserAgent" AND tag::eventtype="OperatingSystem" | rex max_match=0 "eventtype=(?P<Value>(\w+\s+)*)(?<Name>[^\s]+)\s+Options" | eval temp=mvzip(Name,Value,"#") | mvexpand temp | rex field=temp "(?<Name>.*)#(?<Value>.*)" | fields - temp | where Name="Browser"| chart count by Value
Change the filter 'where Name="Browser"' to "OperatingSystem' to get similar chart for Operating Systems.