Splunk Search

using UTF-8 files for CSV lookup

ruiaires
Path Finder

I need to use a .CSV file for a lookup which has accented characters in the field values

If I save the file in ANSI mode, Splunk will complain it is not UTF:

[SimpleResultsTable module] Input is not proper UTF-8, indicate encoding !

If I save the file in UTF-8 mode or UNICODE, the lookup will not work:

# Error 'Could not find all of the specified lookup fields in the lookup table

These edits are being done in Notepad / Windows 😛

jkat54
SplunkTrust
SplunkTrust

Convert your lookup to not have accented characters.

Is the splunk machine nix based? If so, try using dosutils.... dos2unix [filename] to convert to proper format.

Also try using notepad++ not notepad... never use notepad for ETL.

Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...