topic Re: After importing a CSV file in Splunk Light, why is event data displaying in the format "\x002\x00/\x001\x003\..."? in Getting Data In

After importing a CSV file in Splunk Light, why is event data displaying in the format "\x002\x00/\x001\x003\..."?

belljar1 — Tue, 21 Apr 2015 19:49:46 GMT

Hey,

I am a total Splunk Noob. I am trying out Splunk Light. I can successfully import a file, but I cannot get splunk to display the data correctly.

This is an example of how an event looks in splunk once imported from the CSV:

\x002\x00/\x001\x003\x00/\x002\x000\x001\x005\x00 \x001\x002\x00:\x000\x003\x00 \x00A\x00M\x00,\x00I\x00n\x00f\x00o\x00,\x001\x000\x00.\x001\x004\x000\x00.\x009\x000\x00.\x001\x000\x001\x00,\x00"\x00<\x00<\x001\x004\x002\x003\x008\x001\x001\x000\x004\x006\x009\x006\x006\x00>\x00>\x00"\x00,\x00"\x00C\x00C\x00"\x00,\x00"\x000\x000\x000\x00"\x00,\x00"\x00V\x001\x001\x000\x00"\x00,\x00"\x000\x002\x00"\x00,\x00"\x004\x002\x00 \x004\x009\x00 \x004\x00E\x00 \x005\x004\x00 \x005\x002\x00 \x004\x006\x00 \x004\x003\x00 \x004\x005\x00 \x006\x005\x00 \x007\x002\x00 \x007\x002\x00 \x006\x00E\x00 \x006\x00F\x00 \x003\x00D\x00 \x003\x006\x00 \x003\x000\x00 \x000\x000\x00 \x000\x000\x00 \x00(\x00B\x00I\x00N\x00T\x00R\x00F\x00C\x00E\x00e\x00r\x00r\x00n\x00o\x00.\x006\x000\x00.\x00.\x00)\x00"\x00,\x00"\x001\x005\x000\x002\x001\x002\x00"\x00,\x00"\x002\x003\x004\x007\x004\x000\x00"\x00 \x00{\x00o\x006\x00m\x00k\x00D\x00L\x00a\x00w\x00P\x00b\x00o\x00o\x005\x00B\x00D\x00w\x00b\x00W\x00X\x00/\x00G\x00T\x00M\x00s\x00j\x00y\x00w\x008\x00y\x00k\x00M\x00g\x00F\x00L\x00Q\x00f\x00e\x00m\x00z\x009\x00r\x006\x00o\x00=\x00}\x00

The source is a UTF-16 CSV file, and the data should look like this:

2/13/2015 10:12 AM  Info    10.140.13.101   <<1423839912177>>   OpID=99999999 PID=009D NodeID=CC  Store#=0971   10:02:36.17 Fri 02-13-2015    adxcsu0l 3 5 samsyslg.jar {vA0uFbU05eWE7CVrMxNU+x6hylM+o7WdFJYA2vs/Tkk=}

Any idea how I might be able to get Splunk to recognize the data in the fields?

Thanks so much.

Re: After importing a CSV file in Splunk Light, why is event data displaying in the format "\x002\x00/\x001\x003\..."?

martin_mueller — Tue, 21 Apr 2015 20:43:19 GMT

Did you set the charset in props.conf on the forwarder to UTF-16 for that file?

Re: After importing a CSV file in Splunk Light, why is event data displaying in the format "\x002\x00/\x001\x003\..."?

jsven7 — Tue, 13 Oct 2015 12:16:56 GMT

Yes same here I'm having the same problem. Really weird.

Re: After importing a CSV file in Splunk Light, why is event data displaying in the format "\x002\x00/\x001\x003\..."?

jterry — Mon, 04 Apr 2016 23:09:36 GMT

does Splunk Enterprise do the same thing?

Re: After importing a CSV file in Splunk Light, why is event data displaying in the format "\x002\x00/\x001\x003\..."?

meenal901 — Fri, 08 Apr 2016 09:08:40 GMT

If you have Microsoft Excel, open the file and again save is as "CSV". Make sure not to choose "Mac OS".
This means Splunk still cannot read your csv as csv.
In addition, add charset in props.conf while importing this data.