Splunk Search

How to get special characters in logs recognized by Splunk by default?

Path Finder


Log format is JSON

I have a Field named Organization

Now when Organization = "Systèmes" , this will have the following consequences


When doing a search with Organization = "Systèmes" (and doing e.g. a table output), I get no results

When doing a search with Organization = Syst* (and doing e.g. a table output), I get results


I am wondering why Splunk would not recognize this è in the search ...

I read different topics where CHARSET in props.conf file was suggested, but should Splunk not recognize this è by default?

And what would be the solution to get this recognized by Splunk by Default?

Thanks in advance!




Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...