topic Re: Events are showing in binary in Security

Events are showing in binary

Umashankar — Fri, 24 Sep 2021 12:53:41 GMT

After onboarding done, The logs are reporting to splunk, But most of the events are showing like binary as below. The file CHARSET shows UTF-16LE, Have tried Auto also but stil

x00E\x00B\x00U\x00G\x00:\x00g\x00e\x00t\x00D\x00S\x00M\x00U\x00s\x00e\x00r\x00s\x00:\x00G\x00e\x00t\x00t\x00i\x00n\x00g\x00 \x00i\x00n\x00f\x00o\x00r\x00m\x00a\x00t\x00i\x00o\x00n\x00 \x00f\x00o\x00r\x00 \x00R\x00U\x007\x006\x007\x001\x003\x001\x00 \x00 \x00 \x00 \x00D\x00E\x00B\x00U\x00G\x00:\x00g\x00e\x00t\x00D\x00S\x00M\x00U\x00s\x00e\x00r\x00s\x00:\x00S\x00u\x00c\x00c\x00e\x00s\x00s\x00

Props has written as below:

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)

NO_BINARY_CHECK=true

CHARSET=UTF-16LE

disabled=false

DATETIME_CONFIG=CURRENT

Re: Events are showing in binary

eichfuss — Thu, 30 Sep 2021 12:03:11 GMT

Can you explain a bit more about the infrastructure? Are you sending data over the universal forwarder to splunk and where have you configured the props.conf, on the forwarder, indexer, intermediate forwarder, ....?

Re: Events are showing in binary

isoutamo — Thu, 30 Sep 2021 12:37:12 GMT

Have you set this UTF-16LE in UF's configuration file not in indexer or HF?
https://www.aplura.com/assets/pdf/props_conf_order.pdf shows where those should be.
r. Ismo