<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Windows log file ingesting as weird characters in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Windows-log-file-ingesting-as-weird-characters/m-p/400264#M100233</link>
    <description>&lt;P&gt;We are trying to ingest Peregrine logs for Asset Manager and we can open the log file up on the windows server and it is all ascii text, however when Splunk ingests it, it comes in as \x00[\x00p\x00r\x00a\x00t\x00i and so on.  I modified the input from doing a monitor on the log file to powershell:&lt;BR /&gt;
[powershell://MonitorConnSlots]&lt;BR /&gt;
script = . "%SPLUNK_HOME%\etc\apps\FWF_scac_logs\bin\MonitorConnSlots.ps1"&lt;BR /&gt;
interval = 5,35 * * * *&lt;BR /&gt;
recursive = false&lt;BR /&gt;
sourcetype - assetmanagerexport&lt;/P&gt;

&lt;P&gt;The powershell script has:&lt;BR /&gt;
cat c:\Program Files\Peregrine\ACFtp\ACExport\MonitorConnectionSlots.log&lt;/P&gt;

&lt;P&gt;The first 2 times it ingested, it did it correctly, but then reverted back to the weird x00 stuff afterwards.  We have verified with the Peregrine vendor that the logs written out as ASCII text. &lt;/P&gt;

&lt;P&gt;Anyone have any ideas?&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 22:06:17 GMT</pubDate>
    <dc:creator>AndreaSimon</dc:creator>
    <dc:date>2020-09-29T22:06:17Z</dc:date>
    <item>
      <title>Windows log file ingesting as weird characters</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Windows-log-file-ingesting-as-weird-characters/m-p/400264#M100233</link>
      <description>&lt;P&gt;We are trying to ingest Peregrine logs for Asset Manager and we can open the log file up on the windows server and it is all ascii text, however when Splunk ingests it, it comes in as \x00[\x00p\x00r\x00a\x00t\x00i and so on.  I modified the input from doing a monitor on the log file to powershell:&lt;BR /&gt;
[powershell://MonitorConnSlots]&lt;BR /&gt;
script = . "%SPLUNK_HOME%\etc\apps\FWF_scac_logs\bin\MonitorConnSlots.ps1"&lt;BR /&gt;
interval = 5,35 * * * *&lt;BR /&gt;
recursive = false&lt;BR /&gt;
sourcetype - assetmanagerexport&lt;/P&gt;

&lt;P&gt;The powershell script has:&lt;BR /&gt;
cat c:\Program Files\Peregrine\ACFtp\ACExport\MonitorConnectionSlots.log&lt;/P&gt;

&lt;P&gt;The first 2 times it ingested, it did it correctly, but then reverted back to the weird x00 stuff afterwards.  We have verified with the Peregrine vendor that the logs written out as ASCII text. &lt;/P&gt;

&lt;P&gt;Anyone have any ideas?&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 22:06:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Windows-log-file-ingesting-as-weird-characters/m-p/400264#M100233</guid>
      <dc:creator>AndreaSimon</dc:creator>
      <dc:date>2020-09-29T22:06:17Z</dc:date>
    </item>
  </channel>
</rss>

