- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Failed to decode 1945 bytes error: Backup Exe...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Failed to decode 1945 bytes error: Backup Exec logs
I'm trying to preview a backup exec log in Splunk. The log is in XML. When I preview it in spulnk, I get the error:
Failed to decode 1945 bytes; Failed to decode 2049 bytes
Also the preview makes the entire file into gibberish. It looks like this in splunk preview:
\xFF\xFE<\x00?\x00x\x00m\x00l\x00 \x00v\x00e\x00r\x00s\x00i\x00o\x00n\x00=\x00"\x001\x00.\x000\x00"\x00 \x00e\x00n\x00c\x00o\x00d\x00i\x00n\x00g\x00=\x00"\x00U\x00T\x00F\x00-\x001\x006\x00"\x00?\x00>\x00
\x00
\x00<\x00j\x00o\x00b\x00l\x00o\x00g\x00>\x00<\x00j\x00o\x00b\x00_\x00l\x00o\x00g\x00_\x00v\x00e\x00r\x00s\x00i\x00o\x00n\x00 \x00v\x00e\x00r\x00s\x00i\x00o\x00n\x00=\x00"\x002\x00.\x000\x00"\x00/\x00>\x00<\x00h\x00e\x00a\x00d\x00e\x00r\x00>\x00<\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00
\x00
\x00 \x00 \x00<\x00/\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00<\x00s\x00e\x00r\x00v\x00e\x00r\x00>\x00J\x00o\x00b\x00 \x00s\x00e\x00r\x00v\x00e\x00r\x00:\x00 \x00T\x00A\x00P\x00E\x00B\x00A\x00C\x00K\x00U\x00P\x00
\x00
\x00<\x00/\x00s\x00e\x00r\x00v\x00e\x00r\x00>\x00<\x00n\x00a\x00m\x00e\x00>\x00J\x00o\x00b\x00 \x00n\x00a\x00m\x00e\x00:\x00 \x00W\x00e\x00e\x00k\x00l\x00y\x00 \x00T\x00a\x00p\x00e\x00 \x00B\x00a\x00c\x00k\x00u\x00p\x00
\x00
\x00<\x00/\x00n\x00a\x00m\x00e\x00>\x00<\x00s\x00t\x00a\x00r\x00t\x00_\x00t\x00i\x00m\x00e\x00>\x00J\x00o\x00b\x00 \x00s\x00t\x00a\x00r\x00t\x00e\x00d\x00:\x00 \x00T\x00u\x00e\x00s\x00d\x00a\x00y\x00,\x00 \x00A\x00p\x00r\x00i\x00l\x00 \x000\x009\x00,\x00 \x002\x000\x001\x003\x00 \x00a\x00t\x00 \x005\x00:\x003\x000\x00:\x000\x001\x00 \x00A\x00M\x00
\x00
\x00<\x00/\x00s\x00t\x00a\x00r\x00t\x00_\x00t\x00i\x00m\x00e\x00>\x00<\x00t\x00y\x00p\x00e\x00>\x00J\x00o\x00b\x00 \x00t\x00y\x00p\x00e\x00:\x00 \x00B\x00a\x00c\x00k\x00u\x00p\x00
\x00
\x00<\x00/\x00t\x00y\x00p\x00e\x00>\x00<\x00l\x00o\x00g\x00_\x00n\x00a\x00m\x00e\x00>\x00J\x00o\x00b\x00 \x00L\x00o\x00g\x00:\x00 \x00B\x00E\x00X\x00_\x00T\x00A\x00P\x00E\x00B\x00A\x00C\x00K\x00U\x00P\x00_\x000\x000\x000\x008\x007\x00.\x00x\x00m\x00l\x00
\x00
\x00<\x00/\x00l\x00o\x00g\x00_\x00n\x00a\x00m\x00e\x00>\x00<\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00
\x00
\x00 \x00 \x00<\x00/\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00<\x00/\x00h\x00e\x00a\x00d\x00e\x00r\x00>\x00<\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00
\x00
\x00D\x00r\x00i\x00v\x00e\x00 \x00a\x00n\x00d\x00 \x00m\x00e\x00d\x00i\x00a\x00 \x00m\x00o\x00u\x00n\x00t\x00 \x00r\x00e\x00q\x00u\x00e\x00s\x00t\x00e\x00d\x00:\x00 \x004\x00/\x009\x00/\x002\x000\x001\x003\x00 \x005\x00:\x003\x000\x00:\x000\x001\x00 \x00A\x00M\x00
\x00
\x00<\x00/\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00<\x00m\x00e\x00d\x00i\x00a\x00_\x00d\x00r\x00i\x00v\x00e\x00_\x00a\x00n\x00d\x00_\x00m\x00e\x00d\x00i\x00a\x00_\x00i\x00n\x00f\x00o\x00>\x00<\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00
\x00
\x00D\x00r\x00i\x00v\x00e\x00 \x00a\x00n\x00d\x00 \x00m\x00e\x00d\x00i\x00a\x00 \x00i\x00n\x00f\x00o\x00r\x00m\x00a\x00t\x00i\x00o\x00n\x00 \x00f\x00r\x00o\x00m\x00 \x00m\x00e\x00d\x00i\x00a\x00 \x00m\x00o\x00u\x00n\x00t\x00:\x00 \x004\x00/\x009\x00/\x002\x000\x001\x003\x00 \x005\x00:\x003\x001\x00:\x002\x000\x00 \x00A\x00M\x00
\x00
\x00<\x00/\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00<\x00r\x00o\x00b\x00o\x00t\x00i\x00c\x00_\x00l\x00i\x00b\x00r\x00a\x00r\x00y\x00_\x00n\x00a\x00m\x00e\x00>\x00R\x00o\x00b\x00o\x00t\x00i\x00c\x00 \x00L\x00i\x00b\x00r\x00a\x00r\x00y\x00 \x00N\x00a\x00m\x00e\x00:\x00 \x00Q\x00U\x00A\x00N\x00T\x00U\x00M\x00 \x000\x000\x000\x002\x00
\x00
\x00<\x00/\x00r\x00o\x00b\x00o\x00t\x00i\x00c\x00_\x00l\x00i\x00b\x00r\x00a\x00r\x00y\x00_\x00n\x00a\x00m\x00e\x00>\x00<\x00d\x00r\x00i\x00v\x00e\x00_\x00n\x00a\x00m\x00e\x00>\x00D\x00r\x00i\x00v\x00e\x00 \x00N\x00a\x00m\x00e\x00:\x00 \x00Q\x00U\x00A\x00N\x00T\x00U\x00M\x00 \x000\x000\x000\x001\x00
\x00
\x00<\x00/\x00d\x00r\x00i\x00v\x00e\x00_\x00n\x00a\x00m\x00e\x00>\x00<\x00s\x00l\x00o\x00t\x00>\x00S\x00l\x00o\x00t\x00:\x00 \x002\x00
\x00
Anyone have this happening???????
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the solution which works for me is the
CHARSET
attribute in props try to set that to auto. it should work
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found solution to my own problem. I'm running Backup Exec 2010 and the logs are XML. So....open a command prompt and:
From :
c:\Program Files\Symantec\Backup Exec run:
bemcmd -o31 -l"<output file name.txt>" -s0 -f"<job log.xml>"
Here is an example if you wanted to specify the location for the output file and or the job logs are located in another folder.
bemcmd -o31 -l"BEX_TAPEBACKUP_00091.TXT" s0 -f"C:\Program Files\Symantec\Backup Exec\Data\BEX_TAPEBACKUP_00091.xml"
It will convert the xml to plain text and then you can index it in splunk. It would be easy to schedule this as part of a batch script to convert it to txt.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm wondering is it because the xml file is using <> symbols and splunk can't read those?
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
