Hi,
I have the following example record:
30/08/2018 13:30:27.996;VM1;ASH;AccessModule;processPacketBuffer;MSISDN;xxxxxxxxxxxx;;INFO;;;Return Access ; "msisdn":"xxxxxxxxx","Type":"\u0006","APN":"aaa","imsi":"xxxxxxxx","imei":"xxxxxxxxx","SGSN":null,"Remote IP Address":"xx.xx.xx.xx","TotalTimeInMS":0}
I can not search by Type, because it a unicode value and splunk does not parse it correctlly.
The are 2 possible Type values: 1. "\u0006" 2. "\u0003".
I am using the following splunk search:
mysearch | spath input=anyparams | search Type="\u0006"
The problem is that i receive no result,
How should i use the search, when the field contain unicode value?
Thanks in advance,
Yossi
↧