I have configured the inputs.conf to monitor the log file of NetFlow logic
Since the log file is in unreadable format , i set the props.conf to NO_BINARY_CHECK =1
After that i receive the logs in the below format . Is this the correct one ? am i missing something here ?
2014-01-29T05:56:35+00:00 10.0.255.245
\x84R\xE8\x98%\x00d\xD2I\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
\xA6\xA3\x00{\x00\x00\x96\x00\x00
: \x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\xCC\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
"\xB3\xDE\x00\x00\x96\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00-\x00\x00\x00\x00\x00\x00\x00 \xAC
\xAC
\xB3\xDE"\x00\x00\xC6\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\x00\xA4\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
"\xB3\xDD\x00\x00\x96\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\xB0\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
Without knowing the exact format of the file - if the file is in a binary format, you shouldn't be pointing Splunk to read it directly. Splunk has no magic "decoding" of binary files, it indexes what it gets as-is. All you achieve by setting NO_BINARY_CHECK
is to force Splunk to read all that non-readable data even though it doesn't make sense to do so.
What you need is something that will decode this data from the binary format to a textual representation of it, and then have Splunk read that output instead. Again, I don't know the exact format of this file that you're referring to, but some kind of flow reader would do this.
or like the further south located fruit company would say, there is an app for it 😉 http://apps.splunk.com/app/489/