Security

OS and browser extraction from useragent

abhiram
Explorer

Hi,

I need to extract OS and browser details from useragent.
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
I need to capture Web Browser Version and Operating System Version from each user per visit. Is there any easy way that I can get the info instead of writing python script?

Tags (3)

lguinn2
Legend

There is an app that provides a dynamic lookup for user agent strings; it is called TA-uas_parser. Download it from

http://apps.splunk.com/app/1007

It's free. The user agent string can be very complex. I don't recommend that you build this yourself.

justdan23
Path Finder

Is this better than TA-browscap? I'm trying to eval all these Apps to figure out which one to use.

0 Karma

stefandagerman
Path Finder

Well, define 'easy'... 🙂
How familiar are you with regular expressions? Given your example useragent string above, what are your desired values for
- Browser Version
- OS version

julianj
Explorer

I'm having trouble with this as well. The problem for me is I don't exactly know how to handle the varying information within the parenthesis. For example:

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Here, the Windows NT 6.1 is in different locations, so it is very difficult to make a field extraction for Platform Token and Version Token. Any words of advice?

Additionally: I am unable to use an app or script, as I do not have access, and will need advice for the query itself.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...