Skip to main content
Splunk Lantern の記事が日本語で利用できるようになりました。.
Splunk Lantern

Top five most common web browsers


Understanding the browsers and devices that are most often used to access your site helps with software development, such as making decisions about which browsers to test, how to best optimize your site for the end user experience, and which production issues to prioritize. You need to maintain a list of common browsers.

Data required

Web server data


  1. Ensure you are ingesting web server data. This sample search uses the Splunk Add-on for Apache Web Server, but you can replace this source with any other web server data used in your organization. For more information, see About installing Splunk add-ons.
  2. Choose one or two global or critical pages on your site to filter on. Alternatively, if you're leveraging an up/down detector like Pingdom, you can filter on that. The search below is as general as possible but an example of how to filter on a critical page is suggested in the result section at the end of this page.
  3. Run the following search. You can optimize it by specifying an index and adjusting the time range.
tag=web http_user_agent=* 
|top http_user_agent limit=5 useother=true

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation


Search for events that are tagged as web events.


Search for all page requests where the http_user_agent field is present and populated.

If you are using the TA-User-Agents add-on, you can also search by fields other than the user agent, such as the device type or operating system.

|top http_user_agent limit=5 useother=true

Return the top five most frequently occurring, with all remaining user agents grouped into a single series.

You can change useother=true to useother=false if you aren't interested in how the remaining browsers collectively compare to the top five in terms of usage.

Next steps

This search shows the top five user agents, lists the full count for each, and provides the percentage of the full result set for each agent. These results help you know which user agents to focus on to scope interoperability or performance problems. For example, if your performance or page rendering is faulty on your most common user agent, resolving that issue would be a high priority. If the faults are associated with a less common user agent, then you may spend less time fixing the issues and instead elect to communicate to users that a different agent may work better.

The user agent string also contains information about what platform the agent is running on, for example, a smart phone versus a laptop. Content is commonly redirected based on the agent. If you correlate page performance to user agent, you may find that certain content is faster than others and decide to investigate the components that serve the slower content.

Finally, you might be interested in other processes associated with the Managing web server performance use case.