Archive
Highlighted

Alert if emojis are found in logs

How to locate Emojis if they are indexed in Splunk.
Our internal Database doesn't support Emojis but the source system can send Emojis in the request.

Tags (2)
0 Karma
Highlighted

Re: Alert if emojis are found in logs

Ultra Champion

So, you need to detect them and they appear to be Unicode characters encoded as UTF-8.

alt text

Emoji Unicode Tables

0 Karma
Highlighted

Re: Alert if emojis are found in logs

@ddrillic thanks for the reply.

I am unable to attach the screenshot as i dont have enough Karma points.
In the log events, I can already see them as Emojis (smilies) and they are not stopped or converted as there is no transformation rule.

Hence, I want to track / alert on it.

0 Karma
Highlighted

Re: Alert if emojis are found in logs

Path Finder

I have a similar problem, and I ended up writing a custom command which makes use of the Python emoji module to detect emoji in the string.
https://pypi.org/project/emoji/

And here are some info about custom commands, in case you're not familiar with it.
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://www.splunk.com/blog/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-gen...

0 Karma