Splunk Search

using UTF-8 files for CSV lookup

ruiaires
Path Finder

I need to use a .CSV file for a lookup which has accented characters in the field values

If I save the file in ANSI mode, Splunk will complain it is not UTF:

[SimpleResultsTable module] Input is not proper UTF-8, indicate encoding !

If I save the file in UTF-8 mode or UNICODE, the lookup will not work:

# Error 'Could not find all of the specified lookup fields in the lookup table

These edits are being done in Notepad / Windows 😛

jkat54
SplunkTrust
SplunkTrust

Convert your lookup to not have accented characters.

Is the splunk machine nix based? If so, try using dosutils.... dos2unix [filename] to convert to proper format.

Also try using notepad++ not notepad... never use notepad for ETL.

Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...