Splunk Search

field extraction on Chinese characters

cpuppet
Path Finder

There are actually 2 parts in my question

  1. i want to do an field extraction based on my existing field i have read some of the questions on the answers, and found some possible solutions to my problem but was still unable to the it working correctly i tried with n-level transforms.conf and props.conf way using delims as i think it should be an easy way to separate my field since the data is not fixed with the number of different sections it might have another way my also be using rex but i also found out that i was not able to point out exactly where i want to extract my category i listed out both of my source and my props.conf/transforms.conf example here

example.log
date,number,/我愛你/你愛他,last,xx12345
date,number,/我愛你/你愛他/他愛他,last,xx12345
date,number,/我愛你/你愛他/他愛他/他愛我,last,xx12345

props.conf
[example.log]
REPORT-sourcefields = source-fields
REPORT-sourcefield3 = source-field3

transforms.conf
[source-fields]
DELIMS = ","
FIELDS = field1,field2,field3,field4,field5

[source-field3]
SOURCE_KEY = field3
DELIMS = "/"
FIELDS = Category1,Category2,Category3,Category4,Category5,Category6

  1. when using sourcetye="example.log" | rex field=field3 (?^/{1}\w+) in my search command, i found that it will not recognize my Chinese characters when i use \w+ but it works well in my regex tool

anyone has answers to this problem? maybe my regex isn't correct, but i am really exhausted these days...unable to think straight at the moment

Tags (1)
0 Karma

Kate_Lawrence-G
Contributor

I don't think Splunk would recognize it as a word, but maybe as a non-whitespace character?
^/{1}.\/(?\S+)

Thanks,

Kate

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...