I have recently deployed Splunk UF on windows machined, installation and setup is successful. But while searching the logs I am getting Hexadecimal data as below
1\x000\x00-\x002\x009\x00-\x001\x009\x00 \x001\x000\x00:\x004\x000\x00:\x001\x009\x00 \x00P\x00I\x00D\x00=\x005\x007\x007\x006\x00 \x00T\x00H\x00D\x00=\x005\x004\x005\x002\x00 \x00U\x00S\x00R\x00=\x00 \x00M\x00S\x00G\x00=\x000\x00 \x00I\x00N\x00F\x00O\x00 \x00a\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00-
As per Splunk answers i updated the props.conf on indexer as below. But it didn`t resolve the issue.
[sourcetype]
CHARSET = UTF-16LE
NO_BINARY_CHECK = true
Can someone please assist here.
What does your inputs.conf look like on the UF? Is this about the windows event logs, or some other data you're trying to ingest?
Hi dvohra,
are you sure that the charset you used is correct?
What do you receive using "CHARSET = auto"?
Ciao.
Giuseppe
No Difference in search results but warning is not there in splunkd.log
If i am creating props.conf at UF also, it is stopping data ingestion also.
Hi dvohra,
props.conf must be located on Indexers or (when present) on Heavy Forwarders, not on Universal Forwarders, with the inly exception of csv and xml.
Ciao.
Giuseppe