https://community.splunk.com/t5/Splunk-Enterprise-Security/How-can-i-utf8processor-warn-message-using-charser-auto/m-p/479731#M7638 <P>WARN UTF8Processor - Using charset UTF-8, as the monitor is believed over the raw text which may be UTF-16LE - data_source="/var/log/XXX.log", data_host="xxx", data_sourcetype="config"</P> <P>tooo many sourcetypes make this warnning message<BR /> i know, need to change sourcetype in props.conf </P> <P>Using this,</P> <P>[config]<BR /> CHARSET = UTF-16LE</P> <P>But i dont wanna do that<BR /> just...<BR /> I want Splunk to solve it automatically.</P> <P>So, i found a solution</P> <P>[config]<BR /> CHARSET = AUTO</P> <P>However, the message still occurs</P> <P>How can i remove Right way utf8processor warnning msg?</P> Wed, 30 Sep 2020 04:21:46 GMT melonking 2020-09-30T04:21:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-can-i-utf8processor-warn-message-using-charser-auto/m-p/479731#M7638 <P>WARN UTF8Processor - Using charset UTF-8, as the monitor is believed over the raw text which may be UTF-16LE - data_source="/var/log/XXX.log", data_host="xxx", data_sourcetype="config"</P> <P>tooo many sourcetypes make this warnning message<BR /> i know, need to change sourcetype in props.conf </P> <P>Using this,</P> <P>[config]<BR /> CHARSET = UTF-16LE</P> <P>But i dont wanna do that<BR /> just...<BR /> I want Splunk to solve it automatically.</P> <P>So, i found a solution</P> <P>[config]<BR /> CHARSET = AUTO</P> <P>However, the message still occurs</P> <P>How can i remove Right way utf8processor warnning msg?</P> Wed, 30 Sep 2020 04:21:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-can-i-utf8processor-warn-message-using-charser-auto/m-p/479731#M7638 melonking 2020-09-30T04:21:46Z