Splunk Search

Is there a way to track if the useragent changes during a session from IIS logs using the transaction command?

jwalzerpitt
Influencer

Is there a way to see if the useragent changes during a session using the transaction command?

Thx,
Jeff

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your base search | stats values(useragent) as useragent by sessionid | where mvcount(useragent)>1
0 Karma

jwalzerpitt
Influencer

Thx for the reply and search string.

Apologies for not stating earlier that I'm searching through IIS logs, which does not contain a sessionid field

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Then Could you provide details on the logs that you're searching, fields available and possible some sample events?

0 Karma

jwalzerpitt
Influencer

Searching against IIS logs, specifically on the fields c_ip (source IP) and cs_User_Agent.

Without a sessionID I know it's hard, but I was hoping to search for a c_ip whose cs_User_Agent changes within a specified time period, such as one minute, etc,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...