I am running into a problem I cannot seem to figure out. One log file I have splunk reading from suddenly starts reading log entries in what seems to be hexadecimal formats. A sample is as followed:
[\x00R\x00e\x00q\x00u\x00e\x00s\x00t\x00]\x00 \x00h\x00t\x00t\x00p\x00:\x00/\x00/\x00c\x00a\x00t\x00a\x00l\x00o\x00g\x00.\x00d\x00e\x00v\x00.\x00d\x003\x00n\x00w\x00.\x00n\x00e\x00t\x00/\x00c\x00a\x00t\x00a\x00l\x00o\x00g\x00s\x00v\x00c\x00/\x00v\x001\x00/\x00c\x00a\x00t\x00a\x00l\x00o\x00g\x00s\x00/\x00m\x00o\x00v\x00i\x00e\x00p\x00l\x00e\x00x\x00 \x00 \x00[\x00R\x00e\x00s\x00p\x00o\x00n\x00s\x00e\x00]\x00 \x00A\x00c\x00c\x00e\x00p\x00t\x00e\x00d\x00 \x00 \x00 \x00 \x00
First off I have no clue while the file is being read this way as the log file itself seems to have appropriately formatted information in there. What's even stranger though is this isn't a consistent issue. When the file first gets read when setup it reads the data correctly in splunk and has entries displayed as expected. Is there a setting that I may be overlooking that is causing this behavior.
One last thing to note is I have reviewed the log file for any unexpected characters that may be throwing off the encoding rules when splunk is reading the data. However all that is in the file is your typical characters.
Any help is incredibly appreciated.
... View more