Let's break down the search piece by piece.
|
Search fragment |
Description |
| index=main sourcetype=access_combined |
You should now be familiar with this search from the earlier recipes in this chapter. |
| | eval browser=useragent |
Using the eval command, we evaluate a new field called browser and populate it with the contents of the useragent field. |
| | replace *Firefox* with Firefox, *Chrome* with Chrome, *MSIE* with "Internet Explorer", *Version*Safari* with Safari, *Opera* with Opera in browser |
Using the replace command, we use wildcards (*) within the content of the browser field to replace the values with shortened browser names. Note that values that contain spaces require quotes around them, for example, "Internet ... |
