Splunk Search

Why is "�" character found in field values after uploading CSV file and indexing?

dojiepreji
Path Finder

Hi,

After uploading csv file and indexing, I found out that most, if not all of my special characters becomes "�" when viewed in splunk search.

Any help to fix this would be appreciated.
Thank you.

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @dojiepreji,
As explained in the documentation for CSV lookups :

The characters in the CSV file must be plain ASCII text and valid UTF-8 characters. Non-UTF-8 characters are not supported.

More info here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Knowledge/Usefieldlookupstoaddinformationtoyourev...

You should try to replace these characters with character from the UTF-8 set.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @dojiepreji,
As explained in the documentation for CSV lookups :

The characters in the CSV file must be plain ASCII text and valid UTF-8 characters. Non-UTF-8 characters are not supported.

More info here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Knowledge/Usefieldlookupstoaddinformationtoyourev...

You should try to replace these characters with character from the UTF-8 set.

Cheers,
David

0 Karma

denzelchung
Path Finder

How are you creating and saving these csv files?

0 Karma

dojiepreji
Path Finder

I create them from microsoft excel and use export to csv within the app to save it as a csv file. The csv is fine. It is only in splunk that the special characters gets replaced with �.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...