How to update browsercaps file for TA-browscap?

[jonhughes]

I installed TA-browscap and have it working OK, but it seems that the browscap.csv file that the README says to download is a bit out of date - it doesn't seem to recognise IE 11 for example.

I tried downloading what I think is a newer version of the same format file (from browscap.org) but after restarting splunk, any search that I do involving the lookup fails with the error message Script for lookup table 'browscap_lookup' returned with error code 1. Results may be incorrect.

I tried to look into the source code to see if it was a simple problem to fix but I don't know python and I haven't been able to get anywhere.

Are there any simple edits I can make either to the Python source code or the csv file in order to make it work?

[cgbsplunk]

I tried updating browsecap file to csv file from browscap.org but I get the same error below. I can see the file format is different from the last one but in the TA-browscap ver 1.2 it says it was modified to accept the new format. Is there something else in settings I need to set so it knows it is the new format? I checked Splunk settings to make sure I am on ver 1.2 of TA-browscap.

Script for lookup table 'browscap_lookup' returned with error code 1. Results may be incorrect.

[cluettr]

got the same error. doesn't work for me.

robbie

[dshpritz · Accepted solution]

Hey jonhughes,

It appears there was a change in the file format. The module I had been using needed, what turned out, to be a quick fix. I just uploaded v1.2 to Spunkbase, which may take a bit to populate. This version should work with the newer versions of the CSV files.

Thanks,

Dave

[dshpritz]

Please see: http://answers.splunk.com/answers/135078/browscap-ta-not-working-in-61/136751 There is a bug/feature in 6.1 that causes the default TA-browscap to break. I have a workaround, until Splunk replies to the ticket I have open to confirm.

[anandhim]

Hey Dave,

Any updates? We tried with 6.1.2 and it's not working.
Thanks

[dshpritz]

Hey Bruce,

I haven't tested it with 6.1.1 yet. I'll give a shot and update when complete. It will hopefully be by the end of next week.

Dave

[bruceclarke]

Hey Dave,

Do you have any update on getting browscap compatible with 6.1? Seems like it stopped working after the update. As a short term fix, we're using a macro to determine browser type, et al. Just curious if this is being looked into.

Thanks,
Bruce

[GreyGryffin]

I also note that there is a new download URL required.

See the release notes for TA_browscap (http://apps.splunk.com/app/1021/#) or visit http://browscap.org/ and reference the "Important Informaion" section. Old site URL is terminating 4/30/2014.

[jonhughes]

perfect, thanks!