Splunk Search

Does anyone know how query for non alpha numeric characters?

reneedeleon
Engager

Is there a way to search for non-alphanumeric characters?
We have an index that sometimes generates data that contains Kanji and Cyrillic characters, is it possible to create a query that searches for these specifically?

Examples:
user=䉎䝓䰵
host=獵硷灡穱捧灰㈱⸱獵祮扣⹴慢汭挮浯

I know the kanji is not structured correctly but that is how it is showing up in Splunk. Please advise

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

i hope i understand your question
the answer is, yes, search and find out, it worked for me

try this search anywhere:

| makeresults count=1 
| eval data = "user=䉎䝓䰵,host=獵硷灡穱捧灰㈱⸱獵祮扣⹴慢汭挮浯;;;user=ארי,host=דוניו"
| makemv delim=";;;" data
| mvexpand data
| rex field=data "user=(?<user>[^\,]+),host=(?<host>[^\,]+)"
| eval language = if(user=="ארי","Hebrew","Kanji")

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

i hope i understand your question
the answer is, yes, search and find out, it worked for me

try this search anywhere:

| makeresults count=1 
| eval data = "user=䉎䝓䰵,host=獵硷灡穱捧灰㈱⸱獵祮扣⹴慢汭挮浯;;;user=ארי,host=דוניו"
| makemv delim=";;;" data
| mvexpand data
| rex field=data "user=(?<user>[^\,]+),host=(?<host>[^\,]+)"
| eval language = if(user=="ארי","Hebrew","Kanji")

hope it helps

0 Karma

reneedeleon
Engager

That would help but that only searches for those specific characters or all of the possible kanji characters?

0 Karma

adonio
Ultra Champion

i dont have Kanji keyboard, however when i do the following after my search, it works fine:
| search user="ארי"

0 Karma

reneedeleon
Engager

Then is it possible to do an exclusion of all letters from a to z?

0 Karma

adonio
Ultra Champion

not sure where you are heading.
it might need another question.
you can exclude a to z letters with regex something along those lines [A-Za-z]

0 Karma

reneedeleon
Engager

I will give it a try. Thank you.

0 Karma

adonio
Ultra Champion

@reneedeleon
if that sums it up, kindly accept the answer so others will know it addressed your challenge.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...