Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to print unicode as unicode?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to print unicode as unicode?
I have a JSON data source with data like this:
{"download.doc_title": "GCP-7 R\u00f3znorodnosc, R\u00f3wne Szanse Oraz Szacunek W Miejscu Pracy.pdf"}
If I look at the event syntax highlighted, it renders as I would expect:
{ [-]
download.doc_title: GCP-7 Róznorodnosc, Równe Szanse Oraz Szacunek W Miejscu Pracy.pdf
}
...but when I run any reports against, it shows up in the browser with the unicode escapes, instead of the unicode characters:
<searchcriteria> | table download.doc_title
shows
GCP-7 R\u00f3znorodnosc, R\u00f3wne Szanse Oraz Szacunek W Miejscu Pracy.pdf
how do I get it to show the Polish rendition?
GCP-7 Róznorodnosc, Równe Szanse Oraz Szacunek W Miejscu Pracy.pdf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Similar issue at Best practice for dealing with Unicode codepoints in Splunk ?
But not much help there...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi!! Kindly refer to the link below:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Configurecharactersetencoding
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please set CHARSET = AUTO in your props.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The data is apparently being parsed correctly (remember, it displays correctly when syntax is highlighted). Will charset = auto affect parsing or display?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @wegscd!
It affects parsing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The data has been parsed correctly. This is a display side issue.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
