SELECT
CASE strcnt(cs(user-agent),'iPhone') WHEN 1 THEN 'iPhone' ELSE
CASE strcnt(cs(user-agent),'iPad') WHEN 1 THEN 'iPad' ELSE
CASE strcnt(cs(user-agent),'SAMSUNG') WHEN 1 THEN 'Samsung' ELSE
CASE strcnt(cs(user-agent),'Android') WHEN 1 THEN 'Android variant' ELSE 'Other'
END END END END as DeviceType, cs-uri-stem AS Vdir, Count(cs(User-Agent)) as Hits
FROM '[LOGFILEPATH]'
WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%'
GROUP BY DeviceType, Vdir
ORDER BY Hits DESC