topic Re: Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error" in Splunk Search

Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error"

saisrujan28 — Tue, 27 Mar 2018 14:17:16 GMT

| tstats count(host) as count WHERE index=*  earliest=-1d@d latest=@d by host|search [|inputlookup mylast|fields host]

When we use above query, we are getting this error "Regex: UTF-8 error: isolated byte with 0x80 bit set error " But we are able see data without any error if we are using this |inputlookup mylast.

Re: Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error"

niketn — Wed, 28 Mar 2018 04:07:22 GMT

@saisrujan28 can you try the following and confirm?

| tstats count(host) as count WHERE index=*  earliest=-1d@d latest=@d AND [|inputlookup mylast.csv | table host] BY source

Re: Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error"

saisrujan28 — Wed, 28 Mar 2018 07:12:14 GMT

Sorry i am getting same error 😞

Re: Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error"

p_gurav — Wed, 28 Mar 2018 07:24:42 GMT

csv file is in UTF-8 format right?

Re: Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error"

niketn — Wed, 28 Mar 2018 16:14:18 GMT

@saisrujan28, what happens when you run the inputlookup and tstats commands separately. Do they both run as expected?

|inputlookup mylast.csv | table host

And second search as

| tstats count(host) as count WHERE index=*

Re: Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error"

saisrujan28 — Wed, 13 Jun 2018 10:32:49 GMT

yes they working expected when we use them separately

Re: Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error"

niketn — Thu, 14 Jun 2018 03:29:34 GMT

@saisrujan28 check your lookup file again whether there is any special (non-UTF-8) character in it. You can paste the results to notepad and ensure only UTF-8 Characters are present. Or else you can try subset of hosts in your lookup file to pin point the hosat/s that are causing UTF-8 error.