Splunk Search

How can I search to show which browser and browser version users are using?

marshaljoel83
Engager

Hi,

I would like to extract and show the browser and version from the user-agent string, so as to segregate the different versions of the same browser is being used by the users (of our application).

Below is the Splunk query being used to extract the browser details:

index="sample_index" sourcetype="log_alias" operation="log-in" AND userAgent!="-" AND userAgent!="Apache" AND userAgent!="Load-weight" AND userAgent!="Java" AND userAgent!="Jakarta Commons-HttpClient" | stats count(eval(match(userAgent, "Firefox"))) as "Firefox", count(eval(match(userAgent, "Chrome"))) as "Chrome", count(eval(match(userAgent, "Safari") AND NOT match(userAgent, "Chrome"))) as "Safari", count(eval(match(userAgent, "MSIE|Trident"))) as "IE",  count(eval(NOT match(userAgent, "Chrome|Firefox|Safari|MSIE|Trident"))) as "Other" 

This query will result in showing the count of users based on the browser usage. Screenshot of the statistics is shown below:

alt text

I would like to extract and segregate the individual browser based on its version(s).
For instance, if two users using two different versions of Google Chrome browser, that should be extracted.

Please suggest.

Thanks.

DalJeanis
SplunkTrust
SplunkTrust

Start with this base search

index="sample_index" sourcetype="log_alias" operation="log-in" AND userAgent!="-" AND userAgent!="Apache" AND userAgent!="Load-weight" AND userAgent!="Java" AND userAgent!="Jakarta Commons-HttpClient" 

Attached to the above search, run each of the following and look at the interesting fields to identify and locate the name of the field that contains the version number. If it is the same for all of the below, then use that. If it is different, or if no field has the information, then you will have to build a composite field, perhaps using coalesce() or case()

| search match(userAgent, "Firefox") | head 5

| search match(userAgent, "Chrome") | head 5

| search match(userAgent, "Safari") | head 5

| search match(userAgent, "MSIE|Trident") | head 5
0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @marshaljoel83, did you have any luck figuring this out?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...