EVAL, EXTRACT in props.conf not working when using field names with special characters

[ndcl]

Hi,

I try to add some EVAL and EXTRACT to the props.conf of same windows events with german localisation. Because the Events are in german splunk autoextracts the fields with special characters. F.g Domain as Domäne. In the search bar this is no problem:

EVAL newUser = substr(Domäne,-1,1) + substr(Benutzername,2, 3)

works fine but in props.conf:

EVAL-newUser = substr(Domäne,-1,1) + substr(Benutzername,2, 3)

the newUser field does not appear.

This also happened with all props.conf transforms...

how to fix this?

THX

[ndcl · Accepted solution]

figured out by myself: Character Set mismatch between Server and Editor...

[martin_mueller]

In the eval command you can enclose weird field names with single quotes, for example like this:

... | eval foo = 'my weird field name' + 1

Try adding those to your config, maybe it helps there as well...