Splunk Search

Right to left text in a left to right expression causing cursor and keyboard layout issues

landster
Explorer

I am trying to write an eval expression to translate a few different languages into English.   One of the languages is Hebrew which is a right to left language, and when I use the Hebrew text in my query, my cursor location is no longer predictable, and I cannot copy/paste the Hebrew into an otherwise left to right query expression.  I then tried to create a macro to do the evaluation, but I ran into the same issue.  Even using a different browser(Firefox vs. Brave), or a different program (notepad++), but I always encounter the cursor/keyboard anomalies after pasting the text into my query.   I need to translate a few different strings within a case eval expression. 

Is anyone aware of any similar issues being encountered and/or of any potential work arounds? 
Does someone have an alternate suggestion as to how I can accomplish the translations?

Here is an example of what I am trying to do:

| eval appName = case(appName="플레이어","player",appName="티빙","Tving",appName=...

This Hebrew text is an example of where I run into issues:

כאן ארכיון

0 Karma
1 Solution

landster
Explorer

I am using Splunk Enterprise 9.2.1. on CentOS Linux kernel 3.10.0-1160.119.1.el7.x86_64 and my desktop OS is Windows 10 Enterprise.  I do not switch to RTL as I exclusively use LTR.  In this case, the RTL characters are included as titles in some data.

I got it to work by creating a macro for the eval function, and only pasting in the RTL text as the very last step before saving it.   Then I just added the macro to my search query so I did not need to include any of the RTL encoded characters in the search itself explicitly.

 

View solution in original post

0 Karma

jewnix-splunk
Splunk Employee
Splunk Employee

What version of Splunk are you using?

What OS are you using on your desktop?

What do you use to switch the the input fro LTR to RTL?

landster
Explorer

I am using Splunk Enterprise 9.2.1. on CentOS Linux kernel 3.10.0-1160.119.1.el7.x86_64 and my desktop OS is Windows 10 Enterprise.  I do not switch to RTL as I exclusively use LTR.  In this case, the RTL characters are included as titles in some data.

I got it to work by creating a macro for the eval function, and only pasting in the RTL text as the very last step before saving it.   Then I just added the macro to my search query so I did not need to include any of the RTL encoded characters in the search itself explicitly.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...