https://community.splunk.com/t5/Getting-Data-In/Encoding-for-forwarded-data/m-p/99047#M20722 <P>I have files in CP866 encoding. For indexing them in Splunk i made _russian-CP866.ngram file and changed props.conf this way <BR /> [host::<HOST_NAME>]<BR /> CHARSET=russian-CP866<BR /> What should i do for indexing files in CP866 encoding, which are forwarded by universalforwarder from remote host?</HOST_NAME></P> Mon, 28 Sep 2020 10:01:55 GMT andrey2007 2020-09-28T10:01:55Z https://community.splunk.com/t5/Getting-Data-In/Encoding-for-forwarded-data/m-p/99047#M20722 <P>I have files in CP866 encoding. For indexing them in Splunk i made _russian-CP866.ngram file and changed props.conf this way <BR /> [host::<HOST_NAME>]<BR /> CHARSET=russian-CP866<BR /> What should i do for indexing files in CP866 encoding, which are forwarded by universalforwarder from remote host?</HOST_NAME></P> Mon, 28 Sep 2020 10:01:55 GMT https://community.splunk.com/t5/Getting-Data-In/Encoding-for-forwarded-data/m-p/99047#M20722 andrey2007 2020-09-28T10:01:55Z https://community.splunk.com/t5/Getting-Data-In/Encoding-for-forwarded-data/m-p/99048#M20723 <P>CHARSET must be specified on the input, i.e., that config must be on the Universal Forwarder.</P> Thu, 27 Oct 2011 12:55:46 GMT https://community.splunk.com/t5/Getting-Data-In/Encoding-for-forwarded-data/m-p/99048#M20723 gkanapathy 2011-10-27T12:55:46Z https://community.splunk.com/t5/Getting-Data-In/Encoding-for-forwarded-data/m-p/99049#M20724 <P>Where can i do it? In Universal Forwarder there is no ngrams-model folder.</P> Thu, 27 Oct 2011 13:04:11 GMT https://community.splunk.com/t5/Getting-Data-In/Encoding-for-forwarded-data/m-p/99049#M20724 andrey2007 2011-10-27T13:04:11Z