topic Why is Splunk unable to index a converted text file? in Getting Data In

Why is Splunk unable to index a converted text file?

Abilan1 — Fri, 30 Oct 2015 06:54:32 GMT

Hi ,

I have saved the outlook file as a text fie and placed that file into a Splunk monitoring folder. Splunk is just indexing only the 1st line of that text file and for some other converted text files, it is not even indexing a single line. I would like to know if Splunk supports these kind of files or any other way to do this?

Thanks!

Re: Why is Splunk unable to index a converted text file?

asimagu — Fri, 30 Oct 2015 10:50:30 GMT

Open it with Notepad++ for example and check that the encoding is UTF-8

Re: Why is Splunk unable to index a converted text file?

Runals — Fri, 30 Oct 2015 11:57:09 GMT

I'd look in the internal logs (index=_internal) to see if you can get info from it. Might have to look for things like directory path elements, file name, etc.

Re: Why is Splunk unable to index a converted text file?

Abilan1 — Mon, 02 Nov 2015 11:41:20 GMT

Hi,

I have checked the file type, it is UTF-8 encoding. Splunk is indexing only 1st line of that file.

Thanks!