https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-reading-file-just-fine-while-Linux-isn-t/m-p/112933#M23660 <P>This is due to a difference of the default CHARSET setting in the props.conf in Windows vs. Linux.</P> <P>By default, the CHARSET in Windows is set to AUTO, and will determine which CHARSET to use.</P> <P>In Linux, it defaults to UTF-8.</P> <P>The fix is to add the following to the props.conf:</P> <PRE><CODE>[mysourcetype] CHARSET=UTF16-LE </CODE></PRE> Fri, 10 Jul 2015 15:02:22 GMT bosburn_splunk 2015-07-10T15:02:22Z https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-reading-file-just-fine-while-Linux-isn-t/m-p/112932#M23659 <P>I'm migrating from a Windows server to a Linux machine, and I'm finding that the Linux machine isn't reading a specific file. The file is UTF16-LE per the file command:</P> <PRE><CODE>[root@bpoundiag01 xml]# file test.xml test.xml: Little-endian UTF-16 Unicode text, with very long lines </CODE></PRE> <P>Why isn't this working?</P> Fri, 10 Jul 2015 14:59:02 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-reading-file-just-fine-while-Linux-isn-t/m-p/112932#M23659 bosburn_splunk 2015-07-10T14:59:02Z https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-reading-file-just-fine-while-Linux-isn-t/m-p/112933#M23660 <P>This is due to a difference of the default CHARSET setting in the props.conf in Windows vs. Linux.</P> <P>By default, the CHARSET in Windows is set to AUTO, and will determine which CHARSET to use.</P> <P>In Linux, it defaults to UTF-8.</P> <P>The fix is to add the following to the props.conf:</P> <PRE><CODE>[mysourcetype] CHARSET=UTF16-LE </CODE></PRE> Fri, 10 Jul 2015 15:02:22 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-reading-file-just-fine-while-Linux-isn-t/m-p/112933#M23660 bosburn_splunk 2015-07-10T15:02:22Z