Splunk Enterprise Security

After running a search which uses a lookup file to whitelist certain domains, I'm receiving the following error: "Regex: UTF-8 error: byte 2 top bits not 0x80"

samyool36
Explorer

I am attempting to run a search which matches specific domain names. In this search, I am using a lookup file to whitelist certain domains. When I am running this search, I am getting the error: Regex: UTF-8 error: byte 2 top bits not 0x80

My search is as follows:

| tstats `summariesonly` values(Web.dest) as domain min(_time) as firstTime from datamodel=Web by Web.src 
| `drop_dm_object_name("Web")` 
| `ctime(firstTime)`
|  mvexpand domain
| search NOT (domain="exampledomain.com")
|  rex field=domain "www.(?<domain>\S+)"
|  search NOT 
    [| inputlookup whitelisted_domains.csv 
    | rename "Domain Name" as domain
    | fields domain]

I believe the issue appears to be with the lookup file itself. It works if I extract certain fields but not the Domain Name field. Are there limitations in what characters can be included in a lookup like this? Is there something else that may be causing this issue?

0 Karma
1 Solution

samyool36
Explorer

I was able to fix this by doing the following:

  • Export the lookup table from Splunk
  • Open this in Notepad++ and select Encoding > Encode in UTF-8
  • Add the lookup to Splunk

View solution in original post

0 Karma

samyool36
Explorer

I was able to fix this by doing the following:

  • Export the lookup table from Splunk
  • Open this in Notepad++ and select Encoding > Encode in UTF-8
  • Add the lookup to Splunk
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...