About LIUJIEER

LIUJIEER · ‎01-01-2018

Hi Seunomosowon, Hi Seun, I just tried v1.3.6dev with 2 test cases. Test Case 1: Email with Chinese characters in the content. Mail parsed through successfully Test Case 2: Email with Chinese characters in the subject. Mail failed to be parsed Perhaps, you could modify the code to handle the first case as well. Thank you for the help!

LIUJIEER · ‎12-28-2017

Hi Seun, I just tried v1.3.5 with 2 test cases. Test Case 1: Email with Chinese characters in the content. Mail parsed through successfully Test Case 2: Email with Chinese characters in the subject. Mail failed to be parsed Perhaps, you could modify the code to handle the first case as well. Thank you for the help!

LIUJIEER · ‎12-26-2017

I noticed that in props.conf: CHARSET=AUTO Why the above setting isn't enough to recognize foreign characters while parsing the mails in?

LIUJIEER · ‎12-26-2017

You mean I can do something on my Splunk/system settings to support these encodings?

LIUJIEER · ‎12-26-2017

Thank you and appreciate your help!

LIUJIEER · ‎12-25-2017

This TA worked fine with emails in English. However, it does not work for foreign characters such as Chinese, Japanese. I received this debugging message as shown below and it stopped indexing once there is a email with foreign characters in the inbox, unless i annually remove it. ERROR ExecProcessor - message from "python /apps/splunk/etc/apps/TA-mailclient/bin/mail.py" ERRORunknown encoding: iso-2022-jp Is there any way i can index emails with foreign characters with this TA. Alternatively, can i just drop those emails with any foreign characters? Thank you

LIUJIEER · ‎08-23-2016

I realized that when i do a index=INDEX1 Source="*" instead of looking for the specific source using index=INDEX1 Source="xx.xx.xxx" My original query has some output. But not all sources are displayed.

LIUJIEER · ‎08-22-2016

this does not work because with the Source_Address="xx.xx.xxx", the rows with Source as [blank] are filtered out. Left with rows with only Name filled and EquivalentName as [blank]. Therefore, when we do where name=equivalentname will not return any rows

LIUJIEER · ‎08-22-2016

From one single index, there contains the following four fields, Source, Name, EquivalentName (part of the records under EquivalentName having the same data as the field, Name) and Result. Source Name EquivalentName Result A 1$ [blank] [blank] B 2$ [blank] [blank] C 2$ [blank] [blank] D 5$ [blank] [blank] [blank] [blank] 1 X [blank] [blank] 2 Y [blank] [blank] 3 Z [blank] [blank] 4 W The end result: I would like to retrieve the list of Result when searching for a list of Source name. My query looks like this index=INDEX1 Source_Address="xx.xx.xxx" |rex field=Name mode=sed "s/\$//g" |table Source, Name |dedup Name|join Name[|search index=INDEX1 |where condition |rename EquivalentName as Name] |table Name, Result I do not get any results from this. However, when i break down the codes into two queries and retrieve 'manual', i am able to find some results. Not sure what went wrong. Kindly advise, thanks!

Posts	9
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎08-22-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

TA-mailclient handling foreign characters

Join two fields within the same index

Re: TA-mailclient handling foreign characters

Re: TA-mailclient handling foreign characters

Re: TA-mailclient handling foreign characters

Re: TA-mailclient handling foreign characters

Re: TA-mailclient handling foreign characters

TA-mailclient handling foreign characters

Re: Join two fields within the same index

Re: Join two fields within the same index

Join two fields within the same index