topic Re: Right to left text in a left to right expression causing cursor and keyboard layout issues in Splunk Search

Right to left text in a left to right expression causing cursor and keyboard layout issues

landster — Wed, 25 Sep 2024 16:47:09 GMT

I am trying to write an eval expression to translate a few different languages into English. One of the languages is Hebrew which is a right to left language, and when I use the Hebrew text in my query, my cursor location is no longer predictable, and I cannot copy/paste the Hebrew into an otherwise left to right query expression. I then tried to create a macro to do the evaluation, but I ran into the same issue. Even using a different browser(Firefox vs. Brave), or a different program (notepad++), but I always encounter the cursor/keyboard anomalies after pasting the text into my query. I need to translate a few different strings within a case eval expression.

Is anyone aware of any similar issues being encountered and/or of any potential work arounds?
Does someone have an alternate suggestion as to how I can accomplish the translations?

Here is an example of what I am trying to do:

| eval appName = case(appName="플레이어","player",appName="티빙","Tving",appName=...

This Hebrew text is an example of where I run into issues:

כאן ארכיון

Re: Right to left text in a left to right expression causing cursor and keyboard layout issues

jewnix-splunk — Wed, 25 Sep 2024 18:14:20 GMT

What version of Splunk are you using?

What OS are you using on your desktop?

What do you use to switch the the input fro LTR to RTL?

Re: Right to left text in a left to right expression causing cursor and keyboard layout issues

landster — Wed, 25 Sep 2024 18:35:45 GMT

I am using Splunk Enterprise 9.2.1. on CentOS Linux kernel 3.10.0-1160.119.1.el7.x86_64 and my desktop OS is Windows 10 Enterprise. I do not switch to RTL as I exclusively use LTR. In this case, the RTL characters are included as titles in some data.

I got it to work by creating a macro for the eval function, and only pasting in the RTL text as the very last step before saving it. Then I just added the macro to my search query so I did not need to include any of the RTL encoded characters in the search itself explicitly.