Splunk Search

How do I search for accented characters?

DonaldvdHoogenb
Path Finder

Hi,

I have some text data with some accented characters in it.
However, I am not able to search them properly with a Splunk search query.

I have tested some stuff and I noticed the following:

This query works fine and returns the message I created:

| noop | stats count as message | eval message = "hęllo how are you" | search message=*ę*

This query does not work since it gives me 0 results (even though it should return 4 results, since there are 4 messages with this character in it:

index=twitter | search displayBody=*ę*

This query works like it's supposed to and returns many results:

index=twitter | search displayBody=*e*

Also other accented characters cannot be searched in my indexes: (é è ë etc..)
So it seems that Splunk recognizes these characters but I am not able to search them somehow...

Is there a setting of some sort to make sure I can search these characters in my indexes?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi DonaldvdHoogenband,
did you tried with regex command instead search?
Bye.
Giuseppe

0 Karma

DonaldvdHoogenb
Path Finder

HI Giuseppe,

I tried with the following command: | regex _raw="ę"

This also returns 0 events.

Is there anything else I can try?

0 Karma

gcusello
SplunkTrust
SplunkTrust

try with

your_search | regex "\ę"

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...