Splunk Search

How do I search for accented characters?

DonaldvdHoogenb
Path Finder

Hi,

I have some text data with some accented characters in it.
However, I am not able to search them properly with a Splunk search query.

I have tested some stuff and I noticed the following:

This query works fine and returns the message I created:

| noop | stats count as message | eval message = "hęllo how are you" | search message=*ę*

This query does not work since it gives me 0 results (even though it should return 4 results, since there are 4 messages with this character in it:

index=twitter | search displayBody=*ę*

This query works like it's supposed to and returns many results:

index=twitter | search displayBody=*e*

Also other accented characters cannot be searched in my indexes: (é è ë etc..)
So it seems that Splunk recognizes these characters but I am not able to search them somehow...

Is there a setting of some sort to make sure I can search these characters in my indexes?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi DonaldvdHoogenband,
did you tried with regex command instead search?
Bye.
Giuseppe

0 Karma

DonaldvdHoogenb
Path Finder

HI Giuseppe,

I tried with the following command: | regex _raw="ę"

This also returns 0 events.

Is there anything else I can try?

0 Karma

gcusello
SplunkTrust
SplunkTrust

try with

your_search | regex "\ę"

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...