Knowledge Management

Single row results in multiple events

sanjaykattimani
Engager

I have useragent string logged by our application. I am extracting OS and Browser names from these by creating event types (sample data shown below).
Now when i try to chart all OS types with the following search

eventtype="UserAgent" AND tag::eventtype="OperatingSystem" | chart count by eventtype| sort eventtype |rename eventtype as "OperatingSystem"

I get both Browser names and Operating system names as every user agent has both browser and OS event types.

Is there anyway to get only browser names or only OS?

UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.3; .NET4.0C; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
    host=etc   Options|  sourcetype=log85   Options|  source=/app/opt/tomcat/logs/user.log   Options|  index=main   Options|  date_hour=11   Options|  date_mday=11   Options|  eventtype=Internet Explorer Browser   Options|  eventtype= Trident/IE Old Browser   Options|  eventtype=Windows OperatingSystem   Options|  eventtype=UserAgent  
Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Based on your example (single) event, eventtype field should be extracted as multivalue field. You can try something like this.

eventtype="UserAgent" AND tag::eventtype="OperatingSystem" | rex max_match=0 "eventtype=(?P<Value>(\w+\s+)*)(?<Name>[^\s]+)\s+Options" | eval temp=mvzip(Name,Value,"#") | mvexpand temp | rex field=temp "(?<Name>.*)#(?<Value>.*)" | fields - temp | where Name="Browser"| chart count by Value

Change the filter 'where Name="Browser"' to "OperatingSystem' to get similar chart for Operating Systems.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...