Splunk Search

EVAL, EXTRACT in props.conf not working when using field names with special characters

ndcl
Path Finder

Hi,

I try to add some EVAL and EXTRACT to the props.conf of same windows events with german localisation. Because the Events are in german splunk autoextracts the fields with special characters. F.g Domain as Domäne. In the search bar this is no problem:

EVAL newUser = substr(Domäne,-1,1) + substr(Benutzername,2, 3)

works fine but in props.conf:

EVAL-newUser = substr(Domäne,-1,1) + substr(Benutzername,2, 3)

the newUser field does not appear.

This also happened with all props.conf transforms...

how to fix this?

THX

0 Karma
1 Solution

ndcl
Path Finder

figured out by myself: Character Set mismatch between Server and Editor...

View solution in original post

0 Karma

ndcl
Path Finder

figured out by myself: Character Set mismatch between Server and Editor...

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In the eval command you can enclose weird field names with single quotes, for example like this:

... | eval foo = 'my weird field name' + 1

Try adding those to your config, maybe it helps there as well...

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...