I have user logon logs from different countries, and some of their username contain non-English characters, such as Léo, LÓPEZ, PEÑA, etc. They cannot be found when using these characters in search command as keywords, nor using English substitutions like Leo, LOPEZ, PENA.
|search index="user_logon" username=Léo OR username=Leo
Is there any way to replace accented characters with English characters? We're having users from many countries(thus many charsets), so using regex to replace certain characters won't work very efficiently.
If I cannot replace them, will it be possible to make Splunk recognize these characters in search command so that I can search on them directly? For example, by editing props.conf and add a new stanza?