Is there a way to see if the useragent changes during a session using the transaction command?
Thx,
Jeff
Try something like this
your base search | stats values(useragent) as useragent by sessionid | where mvcount(useragent)>1
Thx for the reply and search string.
Apologies for not stating earlier that I'm searching through IIS logs, which does not contain a sessionid field
Then Could you provide details on the logs that you're searching, fields available and possible some sample events?
Searching against IIS logs, specifically on the fields c_ip (source IP) and cs_User_Agent.
Without a sessionID I know it's hard, but I was hoping to search for a c_ip whose cs_User_Agent changes within a specified time period, such as one minute, etc,