Monitoring Splunk

Alert if emojis are found in logs

sanmathikivade
New Member

How to locate Emojis if they are indexed in Splunk.
Our internal Database doesn't support Emojis but the source system can send Emojis in the request.

Tags (2)
0 Karma

patng_nw
Communicator

I have a similar problem, and I ended up writing a custom command which makes use of the Python emoji module to detect emoji in the string.
https://pypi.org/project/emoji/

And here are some info about custom commands, in case you're not familiar with it.
http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://www.splunk.com/blog/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-gen...

0 Karma

ddrillic
Ultra Champion

So, you need to detect them and they appear to be Unicode characters encoded as UTF-8.

alt text

Emoji Unicode Tables

0 Karma

sanmathikivade
New Member

@ddrillic thanks for the reply.

I am unable to attach the screenshot as i dont have enough Karma points.
In the log events, I can already see them as Emojis (smilies) and they are not stopped or converted as there is no transformation rule.

Hence, I want to track / alert on it.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...