Splunk Search

Search with utf-8 codes

torustad
Path Finder

In the loggfile:

[#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et låst oppdrag
javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et låst oppdrag

("Kan ikke oppdatere låst oppdrag")

In the search result and in the "show source":

[#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et l\xE5st oppdrag
javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et l\xE5st oppdrag

("Kan ikke oppdatere et l\xE5st oppdrag")

What can I do to get "låst" instead of "l\xE5st", alternatively how can I search for "l\xE5st"?

Thanks and regards,
Bård Tørustad
Research Council of Norway

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Splunk can be configured for the proper character encoding for an input using the CHARSET option of props.conf. http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

A configuration similar to this may work:

[glassfish]
CHARSET = UTF-8 

Also, review http://www.splunk.com/base/Documentation/4.2.1/Data/Configurecharactersetencoding

Character encoding changes obviously only affect data that is loaded into Splunk after the change is made. It is not retroactive to already-indexed data.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...