topic Re: Does anyone know how query for non alpha numeric characters? in Splunk Search

Does anyone know how query for non alpha numeric characters?

reneedeleon — Thu, 25 Apr 2019 13:56:16 GMT

Is there a way to search for non-alphanumeric characters?
We have an index that sometimes generates data that contains Kanji and Cyrillic characters, is it possible to create a query that searches for these specifically?

Examples:
user=䉎䝓䰵
host=獵硷灡穱捧灰㈱⸱獵祮扣⹴慢汭挮浯

I know the kanji is not structured correctly but that is how it is showing up in Splunk. Please advise

Re: Does anyone know how query for non alpha numeric characters?

adonio — Fri, 26 Apr 2019 02:35:31 GMT

i hope i understand your question
the answer is, yes, search and find out, it worked for me

try this search anywhere:

| makeresults count=1 
| eval data = "user=䉎䝓䰵,host=獵硷灡穱捧灰㈱⸱獵祮扣⹴慢汭挮浯;;;user=ארי,host=דוניו"
| makemv delim=";;;" data
| mvexpand data
| rex field=data "user=(?<user>[^\,]+),host=(?<host>[^\,]+)"
| eval language = if(user=="ארי","Hebrew","Kanji")

hope it helps

Re: Does anyone know how query for non alpha numeric characters?

reneedeleon — Fri, 26 Apr 2019 13:08:49 GMT

That would help but that only searches for those specific characters or all of the possible kanji characters?

Re: Does anyone know how query for non alpha numeric characters?

adonio — Fri, 26 Apr 2019 13:42:37 GMT

i dont have Kanji keyboard, however when i do the following after my search, it works fine:
| search user="ארי"

Re: Does anyone know how query for non alpha numeric characters?

reneedeleon — Tue, 30 Apr 2019 14:54:03 GMT

Then is it possible to do an exclusion of all letters from a to z?

Re: Does anyone know how query for non alpha numeric characters?

adonio — Wed, 01 May 2019 15:45:45 GMT

not sure where you are heading.
it might need another question.
you can exclude a to z letters with regex something along those lines [A-Za-z]

Re: Does anyone know how query for non alpha numeric characters?

reneedeleon — Mon, 06 May 2019 12:11:24 GMT

I will give it a try. Thank you.

Re: Does anyone know how query for non alpha numeric characters?

adonio — Mon, 06 May 2019 12:30:38 GMT

@reneedeleon
if that sums it up, kindly accept the answer so others will know it addressed your challenge.