https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469282#M80740 <PRE><CODE>| makeresults count=256 | streamstats count as code | eval ascii=printf("%c",code) | stats values(ascii) as ascii </CODE></PRE> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Configurecharactersetencoding">Configure character set encoding</A></P> <P>If the encoding is correct, there should be no problem.</P> Sun, 09 Feb 2020 01:41:54 GMT to4kawa 2020-02-09T01:41:54Z https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469281#M80739 <P>My question is simple: which characters are allowed for the values of the metadata fields <CODE>source</CODE> and <CODE>sourcetype</CODE>?</P> <P>I could not find any documentation on this.</P> Sun, 09 Feb 2020 00:20:10 GMT https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469281#M80739 helge 2020-02-09T00:20:10Z https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469282#M80740 <PRE><CODE>| makeresults count=256 | streamstats count as code | eval ascii=printf("%c",code) | stats values(ascii) as ascii </CODE></PRE> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Configurecharactersetencoding">Configure character set encoding</A></P> <P>If the encoding is correct, there should be no problem.</P> Sun, 09 Feb 2020 01:41:54 GMT https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469282#M80740 to4kawa 2020-02-09T01:41:54Z https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469283#M80741 <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Configureindex-timefieldextraction">Field name syntax restrictions</A></P> <PRE><CODE>Field name syntax restrictions You can assign field names as follows: Valid characters for field names are a-z, A-Z, 0-9, or _ . Field names cannot begin with 0-9 or _ . Splunk reserves leading underscores for its internal variables. Avoid assigning field names that match any of the default field names. Do not assign field names that contain international characters. </CODE></PRE> Sun, 09 Feb 2020 01:41:55 GMT https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469283#M80741 to4kawa 2020-02-09T01:41:55Z https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469284#M80742 <P>@to4kawa The link you posted does not seem to apply. I am not asking about field names, but field values. I am going to update the question to make this more clear.</P> Sun, 09 Feb 2020 01:41:56 GMT https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469284#M80742 helge 2020-02-09T01:41:56Z https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469285#M80743 <P>@to4kawa I am not sure you understood my question. Also, you should explain (in detail) how the search you posted just now helps answer my question.</P> Sun, 09 Feb 2020 01:53:42 GMT https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469285#M80743 helge 2020-02-09T01:53:42Z https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469286#M80744 <P>I'm sorry I couldn't meet your request.</P> Sun, 09 Feb 2020 02:06:24 GMT https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469286#M80744 to4kawa 2020-02-09T02:06:24Z https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469287#M80745 <P>The values you assign to those fields are arbitrary strings. They can contain any characters within the specified supported character (more info on that here: <A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Configurecharactersetencoding">https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Configurecharactersetencoding</A>)</P> Mon, 10 Feb 2020 16:07:27 GMT https://community.splunk.com/t5/Getting-Data-In/Allowed-characters-for-metadata-fields-source-and-sourcetype/m-p/469287#M80745 acfecondo75 2020-02-10T16:07:27Z