Let's modify the search to display the types of user operating systems that access our website:
index=main sourcetype=access_combined | eval os=useragent | replace *Windows* with Windows, *Macintosh* with Apple, *Linux* with Linux in os | top limit=3 useother=t os
When the search is run, you should see results similar to the following screenshot:
The search is similar, but this time, we decided to pull the OS-related information from the useragent field and are using it to compare access between major OS types.
