topic Cant ingest csv with £ sign, changes to \XA in Splunk Search

Cant ingest csv with £ sign, changes to \XA

rossparfect — Mon, 21 Jan 2019 18:00:02 GMT

Good evening one and all,

I have CSV files that have monetary values in them, however when they are ingested into splunk I get the following

\xA123,345

Is there away to resolve this pre indexing ,

Thanks

Ross

Re: Cant ingest csv with £ sign, changes to \XA

dkeck — Mon, 21 Jan 2019 18:17:09 GMT

HI,

maybe this provides you with a suitable solution?

https://answers.splunk.com/answers/499555/how-to-parse-the-british-pound-sign-for-currency-f.html

Re: Cant ingest csv with £ sign, changes to \XA

rossparfect — Mon, 21 Jan 2019 19:38:42 GMT

Thanks Dkeck , Id looked at this option, however it was more before the data got indexed rather than after,
However turns out the office 2016 now has a UTF-8 option which recognizes the £ sign, albeit puts it as a character rather than an integer, but it does mean I may be able to regex out the number in a transforms,

Thanks Though,