Splunk Search

using UTF-8 files for CSV lookup

Path Finder

I need to use a .CSV file for a lookup which has accented characters in the field values

If I save the file in ANSI mode, Splunk will complain it is not UTF:

[SimpleResultsTable module] Input is not proper UTF-8, indicate encoding !

If I save the file in UTF-8 mode or UNICODE, the lookup will not work:

# Error 'Could not find all of the specified lookup fields in the lookup table

These edits are being done in Notepad / Windows 😛

SplunkTrust
SplunkTrust

Convert your lookup to not have accented characters.

Is the splunk machine nix based? If so, try using dosutils.... dos2unix [filename] to convert to proper format.

Also try using notepad++ not notepad... never use notepad for ETL.