Splunk Search

How do I search for accented characters?

DonaldvdHoogenb
Path Finder

Hi,

I have some text data with some accented characters in it.
However, I am not able to search them properly with a Splunk search query.

I have tested some stuff and I noticed the following:

This query works fine and returns the message I created:

| noop | stats count as message | eval message = "hęllo how are you" | search message=*ę*

This query does not work since it gives me 0 results (even though it should return 4 results, since there are 4 messages with this character in it:

index=twitter | search displayBody=*ę*

This query works like it's supposed to and returns many results:

index=twitter | search displayBody=*e*

Also other accented characters cannot be searched in my indexes: (é è ë etc..)
So it seems that Splunk recognizes these characters but I am not able to search them somehow...

Is there a setting of some sort to make sure I can search these characters in my indexes?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi DonaldvdHoogenband,
did you tried with regex command instead search?
Bye.
Giuseppe

0 Karma

DonaldvdHoogenb
Path Finder

HI Giuseppe,

I tried with the following command: | regex _raw="ę"

This also returns 0 events.

Is there anything else I can try?

0 Karma

gcusello
SplunkTrust
SplunkTrust

try with

your_search | regex "\ę"

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...