topic Re: Sharepoint logs are coming in Hex in Getting Data In

Sharepoint logs are coming in Hex

mikelanghorst — Mon, 28 Sep 2020 13:44:59 GMT

Attempting to Splunk Sharepoint 2010 logs but it's unreadable in the UI

0\x004\x00/\x001\x007\x00/\x002\x000\x001...

Using the file command on linux, it says the file is UTF-16 Little Endian. Trying to set that charset on the sourcetype doesn't have any effect. In fact seems to conflict in the server, as I get messages that monitor detects UTF-8. Looking at a very old wiki page, mentions
splunk cmd classify

But that classifier is wrong, saying it is UTF-8 binary.

Output of classify:
WARN FileClassifierManager - The file 'FSHPTP02-20130408-1404.log' is invalid. Reason: binary
PROPERTIES OF FSHPTP02-20130408-1404.log
PropertiesMap: {
CHARSET -> UTF-8
invalid_cause -> binary
is_valid -> False
sourcetype -> unknown
}

But the linux file command says otherwise:
[mlanghor@mlanghor-wkstn U]$ file FSHPTP02-20130408-1404.log
FSHPTP02-20130408-1404.log: Little-endian UTF-16 Unicode English text, with very long lines, with CRLF line terminators

Re: Sharepoint logs are coming in Hex

hvandenb — Thu, 23 May 2013 17:20:46 GMT

Any resolution on this I have the same issue.

Re: Sharepoint logs are coming in Hex

jmeyers_splunk — Tue, 04 Nov 2014 23:40:14 GMT

Did you try changing the encoding? see: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configurecharactersetencoding

Re: Sharepoint logs are coming in Hex

mcs24 — Thu, 11 Feb 2016 10:03:14 GMT

See http://wiki.splunk.com/Community:WindowsCharacterEncoding, which provides a solution for
- Logs coming in as hex
- Logs not monitored with the messages: "TailReader - Ignoring file '' due to: binary" and "FileClassifierManager - The file '' is invalid. Reason: binary"