Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Splunk user-agent statistics
| search *
| lookup user_agents http_user_agent as user_agent
| replace "unknown" with "" in ua_device, ua_os_major, ua_os_minor
| replace "Windows*" with "Windows" in ua_os_family
| eval user_agent=ua_os_family + " - " + ua_family
| regex user_agent!="(unknown|PhantomJS)"
| eventstats dc(address) as total
| stats dc(address) as count by user_agent, total
| eval percentage=(count * 100/total)
| table percentage user_agent
| eval percentage=round(percentage, 2)
| sort -percentage
| streamstats sum(percentage) as cumulative_percentage

This comment has been minimized.

Copy link
Owner Author

@yjaaidi yjaaidi commented Apr 30, 2015

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment