Why is my search resulting in "Regex: UTF-8 error: isolated byte with 0x80 bit set error"

[saisrujan28]

| tstats count(host) as count WHERE index=*  earliest=-1d@d latest=@d by host|search [|inputlookup mylast|fields host]

When we use above query, we are getting this error "Regex: UTF-8 error: isolated byte with 0x80 bit set error " But we are able see data without any error if we are using this |inputlookup mylast.

[p_gurav]

csv file is in UTF-8 format right?

[niketn]

@saisrujan28 can you try the following and confirm?

| tstats count(host) as count WHERE index=*  earliest=-1d@d latest=@d AND [|inputlookup mylast.csv | table host] BY source

[saisrujan28]

Sorry i am getting same error 😞

[niketn]

@saisrujan28, what happens when you run the inputlookup and tstats commands separately. Do they both run as expected?

|inputlookup mylast.csv | table host

And second search as

| tstats count(host) as count WHERE index=* 

[saisrujan28]

yes they working expected when we use them separately

[niketn]

@saisrujan28 check your lookup file again whether there is any special (non-UTF-8) character in it. You can paste the results to notepad and ensure only UTF-8 Characters are present. Or else you can try subset of hosts in your lookup file to pin point the hosat/s that are causing UTF-8 error.