Below is the format and I want to import. The data is showing \xA0
where there should be a £
. Please can you send through some recommended settings for props.conf?
Date:\xA001/12/2015
Description:\xA0CARD PAYMENT TO BEECHCROFT,21.40 GBP, RATE 1.00/GBP ON 28-11-2015
Amount:\xA0-21.40\xA0
Balance:\xA0801.96\xA0
Date:\xA001/12/2015
Description:\xA0CARD PAYMENT TO YESSS ELECTRICAL,240.36 GBP, RATE 1.00/GBP ON 28-11-2015
Amount:\xA0-240.36\xA0
Balance:\xA0823.36\xA0
Try this sedcmd
in your props
to remove xA0
from your file at indexing
SEDCMD = s/xA0//g
It's also shows xA0 where I think tabs should be. So it suggests the character encoding on the file is different from that of the system which is consuming the file. Did this file come from UNIX to Windows, if so you can use dosutils in most distros and run the unix2dos
command to convert the encoding. You can also use dos2unix
if you're going the other way.
Also, have you tried specifying the character set on input in your props.conf?
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configurecharactersetencoding
Its part of a bank statement so im not sure about the source. If i remove the xA0 by hand its fine, just annoying additional step.
Hi, @smudge797,
Have you looked into a sed script for the SEDCMD stanza in props.conf?
http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Propsconf
If you haven't already, you might want to consider a replacement or substitution command here.
Here are some examples based on data anonymization:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/Anonymizedata#Anonymize_data_through_a_sed_sc...
Hope this helps!
@frobinson_splunk