Like this:
| makeresults
| eval _raw="182.236.164.11 - - [04/Mar/2019:18:20:56] \"GET /cart.do?action=addtocart&itemId=EST-15&productId=BS-AG-G09&JSESSIONID=SD6SL8FF10ADFF53101 HTTP 1.1\" 200 2252 \"http://www.buttercupgames.com/oldlink?itemId=EST-15\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5\" 506"
| rex "^(?:\S+\s+){4}\"[^\"]+\"\s*(?:\S+\s+){2}(?:\"[^\"]+\"\s*)\"(?<useragent>[^\"]+)"
| rename COMMENT AS "You should already have a 'useragent' field"
| rex field=useragent ";\s+(?<CPU>\S+)"
... View more