Monitoring Splunk

Alert if emojis are found in logs

sanmathikivade
New Member

How to locate Emojis if they are indexed in Splunk.
Our internal Database doesn't support Emojis but the source system can send Emojis in the request.

Tags (2)
0 Karma

patng_nw
Communicator

I have a similar problem, and I ended up writing a custom command which makes use of the Python emoji module to detect emoji in the string.
https://pypi.org/project/emoji/

And here are some info about custom commands, in case you're not familiar with it.
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://www.splunk.com/blog/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-gen...

0 Karma

ddrillic
Ultra Champion

So, you need to detect them and they appear to be Unicode characters encoded as UTF-8.

alt text

Emoji Unicode Tables

0 Karma

sanmathikivade
New Member

@ddrillic thanks for the reply.

I am unable to attach the screenshot as i dont have enough Karma points.
In the log events, I can already see them as Emojis (smilies) and they are not stopped or converted as there is no transformation rule.

Hence, I want to track / alert on it.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...