topic Asian language support in Getting Data In

Asian language support

clyde772 — Fri, 07 May 2010 09:50:30 GMT

Does Splunk have problem showing Language data from Windows server?

It's Korean data that we are indexing, but after the data got indexed the data got changed to Hex code like string. Any idea How I can prevent Splunk to change the data?

BELOW is actual LOG:

        Information 2010-05-07 인터넷접속 12:59:44   DB Pool

BELOW is after Splunk absorved the data:

        Information 2010-05-07 \xBF\xC0\xC0\xFC 12:59:44    DB Pool

Re: Asian language support

Suda — Fri, 07 May 2010 11:04:05 GMT

Hello,

I think you may need to add a CHARSET parameter in your props.conf. I'm not familier with Korean, sorry. But I faced the same issue in Japanese.

If your Korean character set is "EUC-KR", could you try the following steps?

Open or create "props.conf" under $SPLUNK_HOME/etc/system/local.
Add the following parameters in the props.conf.

[your_sourcetype]

CHARSET=EUC-KR
Save it.
Search the following command to apply your changes, or restart your splunk.

| extract reload=t
Try to load your new Korean log files with your sourcetype specified above.

I hope it helps you to solve your issue.

Thank you.

Re: Asian language support

pingqi — Mon, 04 Nov 2013 07:31:58 GMT

Dear Sir,

I have the same problem, if it is Traditional Chinese how to set?

I've tried to use EUC-TW,but Windows Event log contains Traditional Chinese, still appears hex code

Thank you!!