https://community.splunk.com/t5/Getting-Data-In/Can-1-sourcetype-have-2-CHARSET/m-p/493485#M84320 <P>I have a sourcetype named "abc"<BR /> It is configured to CHARSET=UTF_8</P> <P>When I see the events, some events split because of no reason and when i check those particular events, they have encoding of utf-16.</P> <P>What do I do?</P> Tue, 26 Nov 2019 01:58:39 GMT muizash 2019-11-26T01:58:39Z https://community.splunk.com/t5/Getting-Data-In/Can-1-sourcetype-have-2-CHARSET/m-p/493485#M84320 <P>I have a sourcetype named "abc"<BR /> It is configured to CHARSET=UTF_8</P> <P>When I see the events, some events split because of no reason and when i check those particular events, they have encoding of utf-16.</P> <P>What do I do?</P> Tue, 26 Nov 2019 01:58:39 GMT https://community.splunk.com/t5/Getting-Data-In/Can-1-sourcetype-have-2-CHARSET/m-p/493485#M84320 muizash 2019-11-26T01:58:39Z https://community.splunk.com/t5/Getting-Data-In/Can-1-sourcetype-have-2-CHARSET/m-p/493486#M84321 <P>Hi,</P> <P>Can you do the below settings and see whether its solving your issue,</P> <PRE><CODE>[abc] CHARSET=AUTO </CODE></PRE> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Configurecharactersetencoding#Automatically_specify_a_character_set">https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Configurecharactersetencoding#Automatically_specify_a_character_set</A></P> Tue, 26 Nov 2019 07:08:20 GMT https://community.splunk.com/t5/Getting-Data-In/Can-1-sourcetype-have-2-CHARSET/m-p/493486#M84321 techiesid 2019-11-26T07:08:20Z