https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192025#M38271 <P>Or do you forward data using a universal forwarder and send it to a Splunk TCP port <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Monitornetworkports">http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Monitornetworkports</A> instead the default Splunk receiving port <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Enableareceiver#Set_up_receiving">http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Enableareceiver#Set_up_receiving</A></P> Tue, 07 Jul 2015 02:09:13 GMT MuS 2015-07-07T02:09:13Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192023#M38269 <P>Hello,<BR /> I added to the .config file so whatever gets added to a folder will automatically be added to Splunk, however looking through my events I am getting weird characters that are not in the file that look like...</P> <P>Last Name, First name\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#8;\x00X\x00u\x00,\x00 \x00A\x00l\x00a\x00n\x00\x00\x00\x00\x00\x00\x00&#11;\xB0~r\x00\x00\x00\x8A \x00V\x00i\x00s\x00a\x00 \x00I\x00n\x00c\x00.\x00\x00\x00\x00\x00&#15;\xB0~r\x00\x00\x00\x8C&#8;\x00X\x00u\x00,\x00 \x00A\x00l\x00a\x00n\x00\x00\x00\x00\x00\x00\x00&#3;\xB0~r\x00\x00\x00\x88&#16;oMj\xF0\D6Lj&#4;\xD7j</P> Mon, 06 Jul 2015 23:09:41 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192023#M38269 alanxu 2015-07-06T23:09:41Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192024#M38270 <P>A few initial questions, are these binary files (excel files or whatnot) of some sort as opposed to "plain text"? Secondly, are you specifying the correct CHARSET for these files in <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Propsconf">props.conf</A> (Are they ASCII files or are they a different encoding)? </P> Mon, 06 Jul 2015 23:39:28 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192024#M38270 acharlieh 2015-07-06T23:39:28Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192025#M38271 <P>Or do you forward data using a universal forwarder and send it to a Splunk TCP port <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Monitornetworkports">http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Monitornetworkports</A> instead the default Splunk receiving port <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Enableareceiver#Set_up_receiving">http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Enableareceiver#Set_up_receiving</A></P> Tue, 07 Jul 2015 02:09:13 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192025#M38271 MuS 2015-07-07T02:09:13Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192026#M38272 <P>My bet is on two-byte UTF-16, I can spot a <CODE>Xu, Alan</CODE> in between all the zero-bytes.</P> Tue, 07 Jul 2015 05:44:03 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192026#M38272 martin_mueller 2015-07-07T05:44:03Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192027#M38273 <P>Is there a reason why that comes up? Is it the type of file im updloading</P> Tue, 07 Jul 2015 15:17:26 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192027#M38273 alanxu 2015-07-07T15:17:26Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192028#M38274 <P>They are .rtf files.</P> Tue, 07 Jul 2015 15:17:55 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192028#M38274 alanxu 2015-07-07T15:17:55Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192029#M38275 <P>All I did was change the .config file </P> Tue, 07 Jul 2015 15:18:13 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192029#M38275 alanxu 2015-07-07T15:18:13Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192030#M38276 <P>The inputs.config</P> Tue, 07 Jul 2015 15:18:42 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192030#M38276 alanxu 2015-07-07T15:18:42Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192031#M38277 <P>Hmm change props.config? So whats happening is that my file can be in a different format that is specified in the props.conf?</P> Tue, 07 Jul 2015 15:19:23 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192031#M38277 alanxu 2015-07-07T15:19:23Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192032#M38278 <P>It's a mix of how your file is written and how Splunk is trying to understand it. Here's how you would tell Splunk to try to understand the file as UTF-16:</P> <PRE><CODE>props.conf on the Splunk instance reading the file (usually a Universal Forwarder) [your_sourcetype] CHARSET = UTF-16 </CODE></PRE> Tue, 07 Jul 2015 17:29:44 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192032#M38278 martin_mueller 2015-07-07T17:29:44Z https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192033#M38279 <P>So in my \SplunkLightForwarder\default\props.conf</P> <P>I added the lines<BR /> [Log]<BR /> CHARSET = UT-16</P> Thu, 09 Jul 2015 21:42:06 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-odd-data-uploaded-to-my-Splunk/m-p/192033#M38279 alanxu 2015-07-09T21:42:06Z