In the loggfile:
[#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et låst oppdrag
javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et låst oppdrag
("Kan ikke oppdatere låst oppdrag")
In the search result and in the "show source":
[#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et l\xE5st oppdrag
javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et l\xE5st oppdrag
("Kan ikke oppdatere et l\xE5st oppdrag")
What can I do to get "låst" instead of "l\xE5st", alternatively how can I search for "l\xE5st"?
Thanks and regards,
Bård Tørustad
Research Council of Norway
Splunk can be configured for the proper character encoding for an input using the CHARSET
option of props.conf
. http://www.splunk.com/base/Documentation/latest/Admin/Propsconf
A configuration similar to this may work:
[glassfish]
CHARSET = UTF-8
Also, review http://www.splunk.com/base/Documentation/4.2.1/Data/Configurecharactersetencoding
Character encoding changes obviously only affect data that is loaded into Splunk after the change is made. It is not retroactive to already-indexed data.