topic Re: splunk thinks text file is binary in Getting Data In

splunk thinks text file is binary

thinman — Wed, 29 Sep 2010 23:01:14 GMT

I have a file a like to upload to splunk with the following data:

72162397 SANTA CRUZ 00 33527710 01/08/2010 0:01:01 28.00 0.23 72162397 SANTA CRUZ 10 70902676 01/08/2010 0:15:53 1.00 0.20 72162397 SANTA CRUZ 00 70011786 01/08/2010 0:34:20 14.00 0.12 72162397 SANTA CRUZ 00 79052362 01/08/2010 0:35:08 127.00 1.05 [rest of file truncated]

But after upload by "Manager » Data inputs » Files & Directories » Add New" with option "Upload a local file"

I got the following error:

==> /opt/splunk/var/log/splunk/splunkd.log <== 09-29-2010 11:50:56.816 WARN FileClassifierManager - The file 'yumolog.txt' is invalid. Reason: binary

why is splunk thinking the file is binary?

Thanks!!

Re: splunk thinks text file is binary

Branden — Wed, 29 Sep 2010 23:05:43 GMT

Could there be an invisible control character at the start of your file? That happened to me one time...

Re: splunk thinks text file is binary

thinman — Thu, 30 Sep 2010 01:58:52 GMT

Just edited the file with an hex editor and the two first caracters are xA0 (Space character) so no binary data.

Re: splunk thinks text file is binary

Lowell — Thu, 30 Sep 2010 05:16:09 GMT

Do you run into the same problem if you index the file locally? Or does this only occur if your upload the log file? If you have the file indexed locally, you can force-ably disable the binary check, not that doing so is normally a good idea.

Re: splunk thinks text file is binary

thinman — Thu, 30 Sep 2010 05:35:01 GMT

Same problem loading locally

==> /opt/splunk/var/log/splunk/splunkd.log <==
09-29-2010 18:31:47.730 WARN FileClassifierManager - The file '/root/yumolog.txt' is invalid. Reason: binary

I've also adde a dummy text at the begining with no luck....

Re: splunk thinks text file is binary

thinman — Thu, 30 Sep 2010 05:38:41 GMT

[root@splunk ~]# file yumolog.txt

yumolog.txt: ISO-8859 text, with CRLF line terminators

Re: splunk thinks text file is binary

thinman — Thu, 30 Sep 2010 05:47:37 GMT

Looking into file result let me see that you where rigth. change xA0 to x20 and loade correctly.

Thansk!!!!

Re: splunk thinks text file is binary

lpolo — Fri, 19 Oct 2012 12:57:00 GMT

The same problem at the forwarder:

file ////usr/local/rex/azkaban/logs/azkaban.log

///usr/local/rex/azkaban/logs/azkaban.log: ASCII English text

10-03-2012 17:53:21.733 +0000 WARN FileClassifierManager - The file '/usr/local/rex/azkaban/logs/azkaban.log' is invalid. Reason: binary
10-03-2012 17:53:21.734 +0000 INFO TailingProcessor - Ignoring file '/usr/local/rex/azkaban/logs/azkaban.log' due to: binary

Re: splunk thinks text file is binary

arunsundarm — Wed, 30 Sep 2020 02:41:40 GMT

CHARSET=AUTO
or CHARSET=UTF-8( or whatever charset you need to give)
NO_BINARY_CHECK=true
and remeber to delete the fishbucket
this should fix the issue