Browser version in Apache logs

Comments

1 comment

  • Avatar
    Andres Quintero Montana

    The above post seems a little old. I put a query together for Browser version maybe someone else can provide input on it.

    It is meant to capture browser versions, it is work in progress but it seems to run much faster than the one above.

    _sourceCategory=*
    | parse regex "^(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
    | parse regex "(?<method>[A-Z]+)\s(?<url>\S+)\sHTTP/[\d\.]+\"\s(?<status_code>\d+)\s(?<size>[\d-]+)\s\"(?<user_agent>.+?)\".*" nodrop
    | parse regex "(?<OS>\([\w\s\d\.\;\:\/-]+\))" nodrop
    | parse regex "(?<browser>Version\/[\d\.]+\sSafari)" nodrop
    | parse regex "(?<browser>Version\/[\d\.]+\sMobile\/[\d\w]+\sSafari)" nodrop
    | parse regex "(?<browser>Firefox\/[\d\.]+)" nodrop
    | parse regex "(?<browser>Chrome\/[\d\.]+)" nodrop
    | if (browser=="" AND OS=="(Macintosh; Intel Mac OS X 10_12_6)","KHTML, like Gecko",browser) as browser
    | if (browser=="" AND OS=="(iPhone; CPU iPhone OS 9_3_4 like Mac OS X)","Mobile Safari",browser) as browser
    | count by browser | sort by _count

    Cheers

    A

    1
    Comment actions Permalink

Please sign in to leave a comment.