https://community.splunk.com/t5/Getting-Data-In/Overlapping-Inputs-With-Different-Charset/m-p/40203#M7461 <P>hi, Thanks for the input.</P> <P>unfortunately, adding the CHARSET directive into the sourcetype does nothing for me- the entries show up as line noise, just like if the directive wasn't set.</P> Fri, 04 May 2012 15:36:23 GMT tgiles 2012-05-04T15:36:23Z https://community.splunk.com/t5/Getting-Data-In/Overlapping-Inputs-With-Different-Charset/m-p/40201#M7459 <P>Hi, All. I have an overlapping path issue in Windows that I might need some assist on. </P> <P>I have the contents of two directories which need monitoring (all files have the .log extension):</P> <UL> <LI>C:\Program Files\MyApp\Client\ConnLog</LI> <LI>C:\Program Files\MyApp\Client\report</LI> </UL> <P>Looks like Splunk has issues with overlapping monitor inputs[1], so I can't monitor the directories with separate input stanzas. The files in the 'report' directory have (for whatever reason) ISO-8859-1 encoding. Splunk requires a separate props.conf directive so the log files are read correctly.</P> <P>I'm unable to set the input to the parent directory (like "C:\Program Files\MyApp\Client") since the character set change in the report/ directory. Also, there are other files which I don't want to read from the parent directory.</P> <P>Here's an example (not-really-working) configuration I'm using at the moment. </P> <P>Have any thoughts on how I will be able to read the contents of both directories as well as read the report directory with the appropriate character set intact? </P> <P><STRONG>-- inputs.conf</STRONG></P> <PRE><CODE>[monitor://C:\Program Files\MyApp\Client\ConnLog] sourcetype = conn_log followTail = 1 crcSalt = &lt;source&gt; [monitor://C:\Program Files\MyApp\Client\report] sourcetype = report_log followTail = 1 crcSalt = &lt;source&gt; </CODE></PRE> <P><STRONG>-- props.conf</STRONG></P> <PRE><CODE>[source::C:\Program Files\MyApp\Client\report] CHARSET = ISO-8859-1 </CODE></PRE> <P>[1] <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories">http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories</A></P> Tue, 01 May 2012 15:28:12 GMT https://community.splunk.com/t5/Getting-Data-In/Overlapping-Inputs-With-Different-Charset/m-p/40201#M7459 tgiles 2012-05-01T15:28:12Z https://community.splunk.com/t5/Getting-Data-In/Overlapping-Inputs-With-Different-Charset/m-p/40202#M7460 <P>This should work, you can maybe try setting the character set by using sourcetype instead of source:</P> <PRE><CODE>[report_log] CHARSET = ISO-8859-1 </CODE></PRE> <P>Make sure that you added the props.conf file on the forwarder, not the indexer.</P> Tue, 01 May 2012 18:04:38 GMT https://community.splunk.com/t5/Getting-Data-In/Overlapping-Inputs-With-Different-Charset/m-p/40202#M7460 bojanz 2012-05-01T18:04:38Z https://community.splunk.com/t5/Getting-Data-In/Overlapping-Inputs-With-Different-Charset/m-p/40203#M7461 <P>hi, Thanks for the input.</P> <P>unfortunately, adding the CHARSET directive into the sourcetype does nothing for me- the entries show up as line noise, just like if the directive wasn't set.</P> Fri, 04 May 2012 15:36:23 GMT https://community.splunk.com/t5/Getting-Data-In/Overlapping-Inputs-With-Different-Charset/m-p/40203#M7461 tgiles 2012-05-04T15:36:23Z