Skip to main content


Splunk Lantern

Top five most common web browsers

You might need to identify the most common http user agents for a site when doing the following:


In order to execute this procedure in your environment, the following data, services, or apps are required:


Understanding the browsers and devices that are most often used to access your site helps with software development, such as making decisions about which browsers to test, how to best optimize your site for the end user experience, and which production issues to prioritize. You need to maintain a list of common browsers.

To optimize the search shown below, you should specify an index and a time range. In addition, this sample search uses Splunk Add-on for Apache Web Server. You can replace this source with any other web server data used in your organization. 

  1. Verify you deployed a web server add-on to the search heads, so that the needed tags and fields are defined. For more information, see About installing Splunk add-ons.
  2. Choose one or two global or critical pages on your site to filter on. Alternatively, if you're leveraging an up/down detector like Pingdom, you can filter on that. The search below is as general as possible but an example of how to filter on  a critical page is suggested in the result section at the end of this page. 
  3. Run the following search: 
tag=web http_user_agent=* url="<URL of critical page>"
|top http_user_agent limit=5 useother=true

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation


Search for events that are tagged as web events.


Search for all page requests where the http_user_agent field is present and populated.


If you are using the TA-User-Agents add-on, you can also search by fields other than the user agent, such as the device type or operating system.

url="<URL of critical page>"

Filter by a page that represents a valuable action by the client. For example, url="/cart/checkout" provides valuable retail information.  

|top http_user_agent limit=5 useother=true

Return the top five most frequently occurring, with all remaining user agents grouped into a single series.

You can change useother=true to useother=false if you aren't interested in how the remaining browsers collectively compare to the top five in terms of usage. 


This search shows the top five user agents, lists the full count for each, and provides the percentage of the full result set for each agent. These results help you know which user agents to focus on to scope interoperability or performance problems. For example, if your performance or page rendering is faulty on your most common user agent, resolving that issue would be a high priority. If the faults are associated with a less common user agent, then you may spend less time fixing the issues and instead elect to communicate to users that a different agent may work better. 

The user agent string also contains information about what platform the agent is running on, for example, a smart phone versus a laptop. Content is commonly redirected based on the agent. If you correlate page performance to user agent, you may find that certain content is faster than others and decide to investigate the components that serve the slower content. 

  • Was this article helpful?