topic Re: how to ingest binary files to splunk? in Getting Data In

How to ingest binary files to splunk?

Emyamy — Sun, 04 Sep 2022 22:38:40 GMT

Hi Splunkers,

How to ingest binary files to splunk? i get error ," ignored due to binary file".

Any help would be appreciated.

Many thanks

Emy

Re: how to ingest binary files to splunk?

richgalloway — Sun, 04 Sep 2022 16:58:49 GMT

Splunk is a text-based platform and so will not ingest binary files. It makes little sense to do so since Splunk will not be able to search or visualize the binary data

What is your use case? Perhaps there is another solution.

Re: how to ingest binary files to splunk?

Emyamy — Mon, 05 Sep 2022 08:03:57 GMT

Hi @richgalloway

I'm trying to onboard SAP Audit log files to splunk but it is in binary format.

i used below props.conf but doesn't seem to be working as expected.

[sap:test]
CHARSET=UTF-16LE
NO_BINARY_CHECK=false
detect_trailing_nulls = false
inputs.conf:

[monitor:///monitoring_path]
index = sap_testindex
sourcetype = sap:test

Re: how to ingest binary files to splunk?

Emyamy — Mon, 05 Sep 2022 08:04:47 GMT

is there any charset attribute which help converts binary to human readable format?

so i would use it in my props on forwarder.

Re: how to ingest binary files to splunk?

richgalloway — Mon, 05 Sep 2022 13:54:29 GMT

See if this answer helps you. https://community.splunk.com/t5/Getting-Data-In/How-to-Splunk-the-SAP-Security-Audit-Log/m-p/380913