N : A typical Apache weblog contains all the relevant user OS and browser make/model info. If it's in the logs, you'll be able to construct a search in Splunk for it without the use of a special 'Apache' Splunk app. The pertinent user agent information in an apache log looks something like this: "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-us; rv:1.9.2.3) Gecko/20100401 WINFC 2.0.0.1 Firefox/3.6.3 (.NET CLR 3.5.30729)" Where: Mozilla/5.0 is the family of browser (the 5.0 is some legacy netscape business) (Windows; U; Windows NT 6.0; en-us; rv:1.9.2.3) is the general OS and build information: OS, Country Code, Platform, Language Variant, rendering engine version number Gecko/20100401 is the rendering engine and build date Firefox/3.6.3 is the actual browser version used If you're splunking all of your Apache logs, I believe 'useragent' should be an automatically extracted field. Check the 'other interesting fields' section in the light blue field-picking pane within the search app. Clicking through the useragent field will give you the most granular expression of this information, but you'll want to present your results in a much more general format to make an adequate comparison of browser types. I would start the search with eventtype=pageview to restrict the results to only pageview activity. From there i'd be comparing the most general terms - events that include 'firefox' 'safari' etc. This probably doesn't answer your question since I can't think of the correct search off the top of my head, but hopefully this gives you some context and points you in the right direction. ... View more