Allowed characters for metadata fields source and sourcetype

[helge]

My question is simple: which characters are allowed for the values of the metadata fields source and sourcetype?

I could not find any documentation on this.

[acfecondo75 · Accepted solution]

The values you assign to those fields are arbitrary strings. They can contain any characters within the specified supported character (more info on that here: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Configurecharactersetencoding)

[to4kawa]

| makeresults count=256
| streamstats count as code
| eval ascii=printf("%c",code)
| stats values(ascii) as ascii

Configure character set encoding

If the encoding is correct, there should be no problem.

[helge]

@to4kawa I am not sure you understood my question. Also, you should explain (in detail) how the search you posted just now helps answer my question.

[to4kawa]

I'm sorry I couldn't meet your request.

[to4kawa]

Field name syntax restrictions

Field name syntax restrictions
You can assign field names as follows:

Valid characters for field names are a-z, A-Z, 0-9, or _ .
Field names cannot begin with 0-9 or _ . Splunk reserves leading underscores for its internal variables.
Avoid assigning field names that match any of the default field names.
Do not assign field names that contain international characters.

[helge]

@to4kawa The link you posted does not seem to apply. I am not asking about field names, but field values. I am going to update the question to make this more clear.