I am trying to write an eval expression to translate a few different languages into English. One of the languages is Hebrew which is a right to left language, and when I use the Hebrew text in my query, my cursor location is no longer predictable, and I cannot copy/paste the Hebrew into an otherwise left to right query expression. I then tried to create a macro to do the evaluation, but I ran into the same issue. Even using a different browser(Firefox vs. Brave), or a different program (notepad++), but I always encounter the cursor/keyboard anomalies after pasting the text into my query. I need to translate a few different strings within a case eval expression.
Is anyone aware of any similar issues being encountered and/or of any potential work arounds?
Does someone have an alternate suggestion as to how I can accomplish the translations?
Here is an example of what I am trying to do:
| eval appName = case(appName="플레이어","player",appName="티빙","Tving",appName=...
This Hebrew text is an example of where I run into issues:
כאן ארכיון
I am using Splunk Enterprise 9.2.1. on CentOS Linux kernel 3.10.0-1160.119.1.el7.x86_64 and my desktop OS is Windows 10 Enterprise. I do not switch to RTL as I exclusively use LTR. In this case, the RTL characters are included as titles in some data.
I got it to work by creating a macro for the eval function, and only pasting in the RTL text as the very last step before saving it. Then I just added the macro to my search query so I did not need to include any of the RTL encoded characters in the search itself explicitly.
What version of Splunk are you using?
What OS are you using on your desktop?
What do you use to switch the the input fro LTR to RTL?
I am using Splunk Enterprise 9.2.1. on CentOS Linux kernel 3.10.0-1160.119.1.el7.x86_64 and my desktop OS is Windows 10 Enterprise. I do not switch to RTL as I exclusively use LTR. In this case, the RTL characters are included as titles in some data.
I got it to work by creating a macro for the eval function, and only pasting in the RTL text as the very last step before saving it. Then I just added the macro to my search query so I did not need to include any of the RTL encoded characters in the search itself explicitly.