https://community.splunk.com/t5/Getting-Data-In/Event-shows-hexadecimal-when-importing/m-p/53234#M96833 <P>I've got an event log from a sql server that I'm trying to import. When I view the file in a text editor, everything looks readable. When I preview the data in splunk it looks like this:</P> <P>\x002\x000\x001\x003\x00-\x000\x003\x00-\x000\x004\x00 \x000\x008\x00:\x004\x003\x00:\x005\x004\x00.\x009\x005\x00 \x00L\x00o\x00g\x00o\x00n\x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00L\x00o\x00g\x00i\x00n\x00 \x00s\x00u\x00c\x00c\x00e\x00e\x00d\x00e\x00d\x00 \x00f\x00o\x00r\x00 \x00u\x00s\x00e\x00r\x00 \x00'\x00S\x00E\x00T\x00S\x00D\x00B\x00'\x00.\x00 \x00C\x00o\x00n\x00n\x00e\x00c\x00t\x00i\x00o\x00n\x00:\x00 \x00n\x00o\x00n\x00-\x00t\x00r\x00u\x00s\x00t\x00e\x00d\x00.\x00 \x00[\x00C\x00L\x00I\x00E\x00N\x00T\x00:\x00 \x001\x000\x00.\x001\x00.\x002\x005\x00.\x001\x007\x00]\x00</P> <P>Any thoughts?</P> <P>Scott</P> Wed, 06 Mar 2013 18:01:25 GMT madmoravian 2013-03-06T18:01:25Z https://community.splunk.com/t5/Getting-Data-In/Event-shows-hexadecimal-when-importing/m-p/53234#M96833 <P>I've got an event log from a sql server that I'm trying to import. When I view the file in a text editor, everything looks readable. When I preview the data in splunk it looks like this:</P> <P>\x002\x000\x001\x003\x00-\x000\x003\x00-\x000\x004\x00 \x000\x008\x00:\x004\x003\x00:\x005\x004\x00.\x009\x005\x00 \x00L\x00o\x00g\x00o\x00n\x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00L\x00o\x00g\x00i\x00n\x00 \x00s\x00u\x00c\x00c\x00e\x00e\x00d\x00e\x00d\x00 \x00f\x00o\x00r\x00 \x00u\x00s\x00e\x00r\x00 \x00'\x00S\x00E\x00T\x00S\x00D\x00B\x00'\x00.\x00 \x00C\x00o\x00n\x00n\x00e\x00c\x00t\x00i\x00o\x00n\x00:\x00 \x00n\x00o\x00n\x00-\x00t\x00r\x00u\x00s\x00t\x00e\x00d\x00.\x00 \x00[\x00C\x00L\x00I\x00E\x00N\x00T\x00:\x00 \x001\x000\x00.\x001\x00.\x002\x005\x00.\x001\x007\x00]\x00</P> <P>Any thoughts?</P> <P>Scott</P> Wed, 06 Mar 2013 18:01:25 GMT https://community.splunk.com/t5/Getting-Data-In/Event-shows-hexadecimal-when-importing/m-p/53234#M96833 madmoravian 2013-03-06T18:01:25Z https://community.splunk.com/t5/Getting-Data-In/Event-shows-hexadecimal-when-importing/m-p/53235#M96834 <P>This seems to be an encoding mismatch. These should provide some insight:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/data/Configurecharactersetencoding">http://docs.splunk.com/Documentation/Splunk/5.0.2/data/Configurecharactersetencoding</A></P> <P><A href="http://wiki.splunk.com/Community:WindowsCharacterEncoding">http://wiki.splunk.com/Community:WindowsCharacterEncoding</A></P> Fri, 15 Mar 2013 06:33:08 GMT https://community.splunk.com/t5/Getting-Data-In/Event-shows-hexadecimal-when-importing/m-p/53235#M96834 sbrant_splunk 2013-03-15T06:33:08Z