Splunk Search

How do I search for accented characters?

DonaldvdHoogenb
Path Finder

Hi,

I have some text data with some accented characters in it.
However, I am not able to search them properly with a Splunk search query.

I have tested some stuff and I noticed the following:

This query works fine and returns the message I created:

| noop | stats count as message | eval message = "hęllo how are you" | search message=*ę*

This query does not work since it gives me 0 results (even though it should return 4 results, since there are 4 messages with this character in it:

index=twitter | search displayBody=*ę*

This query works like it's supposed to and returns many results:

index=twitter | search displayBody=*e*

Also other accented characters cannot be searched in my indexes: (é è ë etc..)
So it seems that Splunk recognizes these characters but I am not able to search them somehow...

Is there a setting of some sort to make sure I can search these characters in my indexes?

0 Karma

gcusello
Esteemed Legend

Hi DonaldvdHoogenband,
did you tried with regex command instead search?
Bye.
Giuseppe

0 Karma

DonaldvdHoogenb
Path Finder

HI Giuseppe,

I tried with the following command: | regex _raw="ę"

This also returns 0 events.

Is there anything else I can try?

0 Karma

gcusello
Esteemed Legend

try with

your_search | regex "\ę"

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...