Alert if emojis are found in logs

[sanmathikivade]

How to locate Emojis if they are indexed in Splunk.
Our internal Database doesn't support Emojis but the source system can send Emojis in the request.

[patng_nw]

I have a similar problem, and I ended up writing a custom command which makes use of the Python emoji module to detect emoji in the string.
https://pypi.org/project/emoji/

And here are some info about custom commands, in case you're not familiar with it.
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://www.splunk.com/blog/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-gen...

[ddrillic]

So, you need to detect them and they appear to be Unicode characters encoded as UTF-8.

Emoji Unicode Tables

[sanmathikivade]

@ddrillic thanks for the reply.

I am unable to attach the screenshot as i dont have enough Karma points.
In the log events, I can already see them as Emojis (smilies) and they are not stopped or converted as there is no transformation rule.

Hence, I want to track / alert on it.