https://community.splunk.com/t5/Monitoring-Splunk/UTF8Processor-warning-message/m-p/146074#M1675 <P>Your HF is parsing, whatever it is you have set up for the sourcetype on the indexer needs to be on the HF too.</P> Fri, 11 Mar 2016 16:54:50 GMT gavsdavs_GR 2016-03-11T16:54:50Z https://community.splunk.com/t5/Monitoring-Splunk/UTF8Processor-warning-message/m-p/146073#M1674 <P>Hi there,</P> <P>I have CHARSET = UTF-16LE enforced in props.conf for all universal forwarders. </P> <P>For UniForwarder -&gt; Indexer this all works correctly. However, for UniForwarder -&gt; HeavyForwareder -&gt; Indexer this causes an WARN log entry for each processed event on the heavy forwarder:</P> <P><CODE>12-04-2014 15:27:48.026 +0000 WARN UTF8Processor - Using charset UTF-8, as the monitor is believed over the raw text which may be UTF-16LE</CODE></P> <P>Any ideas what I can do to fix this? It's currently being indexed correctly, but generating 1000's of WARN's a minute.</P> <P>Thanks in advance</P> Fri, 05 Dec 2014 16:56:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/UTF8Processor-warning-message/m-p/146073#M1674 ollie920049 2014-12-05T16:56:50Z https://community.splunk.com/t5/Monitoring-Splunk/UTF8Processor-warning-message/m-p/146074#M1675 <P>Your HF is parsing, whatever it is you have set up for the sourcetype on the indexer needs to be on the HF too.</P> Fri, 11 Mar 2016 16:54:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/UTF8Processor-warning-message/m-p/146074#M1675 gavsdavs_GR 2016-03-11T16:54:50Z