Splunk Search

Why is "�" character found in field values after uploading CSV file and indexing?

dojiepreji
Path Finder

Hi,

After uploading csv file and indexing, I found out that most, if not all of my special characters becomes "�" when viewed in splunk search.

Any help to fix this would be appreciated.
Thank you.

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @dojiepreji,
As explained in the documentation for CSV lookups :

The characters in the CSV file must be plain ASCII text and valid UTF-8 characters. Non-UTF-8 characters are not supported.

More info here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Knowledge/Usefieldlookupstoaddinformationtoyourev...

You should try to replace these characters with character from the UTF-8 set.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @dojiepreji,
As explained in the documentation for CSV lookups :

The characters in the CSV file must be plain ASCII text and valid UTF-8 characters. Non-UTF-8 characters are not supported.

More info here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Knowledge/Usefieldlookupstoaddinformationtoyourev...

You should try to replace these characters with character from the UTF-8 set.

Cheers,
David

0 Karma

denzelchung
Path Finder

How are you creating and saving these csv files?

0 Karma

dojiepreji
Path Finder

I create them from microsoft excel and use export to csv within the app to save it as a csv file. The csv is fine. It is only in splunk that the special characters gets replaced with �.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...