https://community.splunk.com/t5/Getting-Data-In/How-to-index-Mcafee-HIPS-logs/m-p/160499#M32535 <P>After discovering the event.log was binary-- but the file would seemingly load up fine in notepad, or notepad++.. I discovered the file was actually in a different character set called UCS-2 LE, which according to (<A href="http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Configurecharactersetencoding">http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Configurecharactersetencoding</A>) maps to the utf-16le characterset- that I had to specify that in the props.conf on the forwarder.</P> <PRE><CODE>[monitor://C:ProgramDataMcAfeeHost Intrusion PreventionEvent.log] index= disabled = 0 sourcetype = hipsfw followTail = 1 </CODE></PRE> <P>in props.conf (still on forwarder)</P> <PRE><CODE>[hipsfw] NO_BINARY_CHECK = true CHARSET = utf-16le </CODE></PRE> Mon, 02 Nov 2015 11:58:41 GMT daniel_goolsby_ 2015-11-02T11:58:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-Mcafee-HIPS-logs/m-p/160498#M32534 <P>Hello</P> <P>Mcafee HIPS logs are written on all laptops and basically contain firewall like data. The issue is HIPS logs are written in unicode text format which Splunk sees as a binary file. Has anyone had any success in trying to index hips logs into splunk? </P> <P>Thanks</P> Thu, 26 Feb 2015 15:55:36 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-Mcafee-HIPS-logs/m-p/160498#M32534 theouhuios 2015-02-26T15:55:36Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-Mcafee-HIPS-logs/m-p/160499#M32535 <P>After discovering the event.log was binary-- but the file would seemingly load up fine in notepad, or notepad++.. I discovered the file was actually in a different character set called UCS-2 LE, which according to (<A href="http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Configurecharactersetencoding">http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Configurecharactersetencoding</A>) maps to the utf-16le characterset- that I had to specify that in the props.conf on the forwarder.</P> <PRE><CODE>[monitor://C:ProgramDataMcAfeeHost Intrusion PreventionEvent.log] index= disabled = 0 sourcetype = hipsfw followTail = 1 </CODE></PRE> <P>in props.conf (still on forwarder)</P> <PRE><CODE>[hipsfw] NO_BINARY_CHECK = true CHARSET = utf-16le </CODE></PRE> Mon, 02 Nov 2015 11:58:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-Mcafee-HIPS-logs/m-p/160499#M32535 daniel_goolsby_ 2015-11-02T11:58:41Z