Hi after upgrading to Splunk 8.0 our searches with UTF-8 characters failed to work.
Why can't we search on data with UTF-8 in it when using (| search "*Test UTFø*") ?
Why does it work when searching on field name username or _raw. (username="*Test UTFø*") ?
Fails:
(index="test" source="desktop.*") app_key="*" name="*" "*Test UTFø*"
(index="test" source="desktop.*") app_key="*" name="*" | search "*Test UTFø*"
Works if you search on field name or _raw data:
(index="test" source="desktop.*") app_key="*" name="*" username="*Test UTFø*"
(index="test" source="desktop.*") app_key="*" name="*" _raw="*Test UTFø*"
props.conf file for source type:
[json_test_sourcetype]
KV_MODE = json
SHOULD_LINEMERGE = true
TZ = UTC
MAX_TIMESTAMP_LOOKAHEAD = 100
disabled = false
data example:
{"timestamp_utc": "2019-11-12T08:35:01", "app_key": "5b040a68d053080b70309991", "node_key": "5b192965d053082f4c708e9b", "country": "DK", "location": "DK", "ui": "outlook.exe", "ui_path": "C:\Program Files (x86)\Microsoft Office\root\Office16\", "ui_version": "16.0.12130.20272", "name": "New Mail", "time": 5.06, "failed": 0, "key": "5cbf0b96d0530842ea18ead6", "session_id": "6", "session_guid": "", "id": "705c43b7-eaf4-4505-xxxx-e681f8d04b18", "username": "Test UTFøTest", "ip": "", "local_ip": "", "client_ip": "", "identifier": "", "title": "", "sla": 1, "sla1": 5, "sla2": 20, "use_sla": 1}
