{"id":6366,"date":"2017-06-23T14:04:15","date_gmt":"2017-06-23T19:04:15","guid":{"rendered":"http:\/\/appcrawler.com\/wordpress\/?p=6366"},"modified":"2017-06-24T11:38:56","modified_gmt":"2017-06-24T16:38:56","slug":"splunk-query-to-print-distribution-of-requests-by-device-type","status":"publish","type":"post","link":"http:\/\/appcrawler.com\/wordpress\/2017\/06\/23\/splunk-query-to-print-distribution-of-requests-by-device-type\/","title":{"rendered":"Splunk &#8211; Query to print distribution of requests by device type"},"content":{"rendered":"<p>We had a need to understand what type of devices our customers were using; specifically, Apple or Android.  We came up with what is below&#8230;<\/p>\n<pre>\r\nhost=cmhlpecomweb* sourcetype=access* (\"iphone\" OR \"ipad\" OR \"android\")\r\n  | rex mode=sed field=_raw \"s\/\\t\/~\/g\"\r\n  | eval tmp=split(_raw,\"~\") \r\n  | eval agent=mvindex(tmp,10)\r\n  | eval jsessionid = mvindex(tmp,14) \r\n  | rex field=agent \"(?<agent2>[a,A]ndroid)\" \r\n  | eval device_type=if(agent2!=\"\",\"android\",\"apple\") \r\n  | dedup device_type,jsessionid\r\n  | stats count as cnt by device_type\r\n<\/pre>\n<p>This will come up with a list of unique combinations of device and session ID, and then print a count of each distinct device type.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We had a need to understand what type of devices our customers were using; specifically, Apple or Android. We came up with what is below&#8230; host=cmhlpecomweb* sourcetype=access* (&#8220;iphone&#8221; OR &#8220;ipad&#8221; OR &#8220;android&#8221;) | rex mode=sed field=_raw &#8220;s\/\\t\/~\/g&#8221; | eval tmp=split(_raw,&#8221;~&#8221;)&hellip;<\/p>\n<p class=\"more-link-p\"><a class=\"more-link\" href=\"http:\/\/appcrawler.com\/wordpress\/2017\/06\/23\/splunk-query-to-print-distribution-of-requests-by-device-type\/\">Read more &rarr;<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[83,84,81],"tags":[],"_links":{"self":[{"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/posts\/6366"}],"collection":[{"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/comments?post=6366"}],"version-history":[{"count":6,"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/posts\/6366\/revisions"}],"predecessor-version":[{"id":6373,"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/posts\/6366\/revisions\/6373"}],"wp:attachment":[{"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/media?parent=6366"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/categories?post=6366"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/appcrawler.com\/wordpress\/wp-json\/wp\/v2\/tags?post=6366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}