Does anyone have examples of how to use Splunk to identify popular web browsers?
The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.
Application developers can identify which web browsers that people use most to often access your web applications so you can decide which browsers to support or stop supporting.
How to implement: This example use case depends on web server logs.
Install and configure the Splunk Add-On for Apache Web Server from Splunkbase. For details, see Splunk Add-on for Apache Web Server.
Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main
.
Data check: Run the following search to verify you are searching for normalized web data that is ready for this use case:
earliest=-1day index=* tag=web
| head 10
Identify the most popular web browsers customers use to access your web applications.
Run the following search.
index=* tag=web
| stats count BY http_user_agent
| replace *Firefox* with Firefox, *Chrome* with Chrome, *MSIE* with "Internet Explorer", *Version*Safari* with Safari, *Opera* with Opera, *rv:11.0* with "Internet Explorer" in http_user_agent
| top
Best practice: In searches, replace the asterisk in index=*
with the name of the index that contains the data. By default, Splunk stores data in the main
index. Therefore, index=*
becomes index=main
. Use the OR
operator to specify one or multiple indexes to search. For example, index=main OR index=security
. See About managing indexes and How indexing works in Splunk docs for details.
If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.
For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.
For more support, post a question to the Splunk Answers community.
looks still need additonal modify ?
The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.
Application developers can identify which web browsers that people use most to often access your web applications so you can decide which browsers to support or stop supporting.
How to implement: This example use case depends on web server logs.
Install and configure the Splunk Add-On for Apache Web Server from Splunkbase. For details, see Splunk Add-on for Apache Web Server.
Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main
.
Data check: Run the following search to verify you are searching for normalized web data that is ready for this use case:
earliest=-1day index=* tag=web
| head 10
Identify the most popular web browsers customers use to access your web applications.
Run the following search.
index=* tag=web
| stats count BY http_user_agent
| replace *Firefox* with Firefox, *Chrome* with Chrome, *MSIE* with "Internet Explorer", *Version*Safari* with Safari, *Opera* with Opera, *rv:11.0* with "Internet Explorer" in http_user_agent
| top
Best practice: In searches, replace the asterisk in index=*
with the name of the index that contains the data. By default, Splunk stores data in the main
index. Therefore, index=*
becomes index=main
. Use the OR
operator to specify one or multiple indexes to search. For example, index=main OR index=security
. See About managing indexes and How indexing works in Splunk docs for details.
If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.
For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.
For more support, post a question to the Splunk Answers community.