Splunk Search

How to search on non-English keywords?

vj1226
New Member

Hello,
I have user logon logs from different countries, and some of their username contain non-English characters, such as Léo, LÓPEZ, PEÑA, etc. They cannot be found when using these characters in search command as keywords, nor using English substitutions like Leo, LOPEZ, PENA.

|search index="user_logon" username=Léo OR username=Leo

Is there any way to replace accented characters with English characters? We're having users from many countries(thus many charsets), so using regex to replace certain characters won't work very efficiently.

If I cannot replace them, will it be possible to make Splunk recognize these characters in search command so that I can search on them directly? For example, by editing props.conf and add a new stanza?

Thanks in advance,

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

See the answer here - https://answers.splunk.com/answers/516467/lookup-csv-with-nuai-characters-germanspanishfrenc.html

You probably need to verify the encoding you are using is appropriate to the range of potential values...

https://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Configurecharactersetencoding

0 Karma

Azeemering
Builder

How is it displayed in the actual logifle that is indexed?

When I use quotes it works for me:

|search index="user_logon" username="Léo" OR username=Leo
I have tested this with my splunk instance and this works for me.

0 Karma

vj1226
New Member

Than you for your answer! However, it does not work with quotes neither. In actual logfile we have a field "Name" with all usernames like "Xxxx PEÑA" and "Léo XXXX"

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...