Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

How to break events while indexing

$
0
0

Hi,

I have events which logging user agents information,

USR_AGNT="Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36"

In the above log events, we have browser information as well as OS information, How i can transform it while indexing into two different key such OS_INFO (operating system related information) and BRW_INFO (Browser related information) under USR_AGNT.


Viewing all articles
Browse latest Browse all 13053

Trending Articles