topic Re: Can you help me with a source type issue involving advanced parameters? in Getting Data In

Can you help me with a source type issue involving advanced parameters?

jip31 — Mon, 29 Oct 2018 14:18:30 GMT

Hello,

I need to create a source type from a log file in an attachment.
But, when I upload the file, I have a result like below:

x00-\x00+\x00+\x00-\x00 \x00C\x00:\x00

what is the problem please???

ddrillic — Mon, 29 Oct 2018 14:33:46 GMT

I used the solution prescribed by @JSapienza in props.conf of the indexers and it worked perfectly fine -

SEDCMD-StripNULL= s/\x00//g

Please let us know.

harsmarvania57 — Mon, 29 Oct 2018 14:42:22 GMT

This is mostly due to character encoding. If you know that what type of character set is present in your log file then you can use CHARSET parameter in props.conf, more documentation http://docs.splunk.com/Documentation/Splunk/7.2.0/Data/Configurecharactersetencoding

jip31 — Mon, 29 Oct 2018 15:04:49 GMT

thanks but it doesnt work for me