topic Re: UTF-16 File Format-Data Ingestion in Installation

UTF-16 File Format-Data Ingestion

SplunkDash — Thu, 13 Jan 2022 20:21:52 GMT

Hello,

I know ....SPLUNK needs to have UTF-8 data format to ingest data into SPLUNK. But I have some XML files with UTF-16 format. Are there any ways we can ingest UTF-16 formatted files? Any help will be appreciated ...thank you so much.

Re: UTF-16 File Format-Data Ingestion

isoutamo — Thu, 13 Jan 2022 21:11:46 GMT

Have you tried CHARSET on props.conf on UF/source node? https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf
r. Ismo

Re: UTF-16 File Format-Data Ingestion

SplunkDash — Thu, 13 Jan 2022 21:24:20 GMT

Hello,

Thank you so much appreciate your response. I tried with following codes, but not working. Any help will be highly appreciated. Thank you so much again.

[ <SOURCETYPE NAME> ]

SHOULD_LINEMERGE=true

LINE_BREAKER=([\r\n]+)

NO_BINARY_CHECK=true

CHARSET=UTF-8

disabled=false

detect_trailing_nulls=false

Re: UTF-16 File Format-Data Ingestion

isoutamo — Mon, 17 Jan 2022 17:43:08 GMT

CHARSET option must be on source system (UF) and that must restated after props.conf change.