topic Re: Issue :- Searching hexadecimal Data from Windows host in Splunk Search

Issue :- Searching hexadecimal Data from Windows host

dvohra — Wed, 30 Sep 2020 02:43:19 GMT

I have recently deployed Splunk UF on windows machined, installation and setup is successful. But while searching the logs I am getting Hexadecimal data as below

1\x000\x00-\x002\x009\x00-\x001\x009\x00 \x001\x000\x00:\x004\x000\x00:\x001\x009\x00 \x00P\x00I\x00D\x00=\x005\x007\x007\x006\x00 \x00T\x00H\x00D\x00=\x005\x004\x005\x002\x00 \x00U\x00S\x00R\x00=\x00 \x00M\x00S\x00G\x00=\x000\x00 \x00I\x00N\x00F\x00O\x00 \x00a\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00-

As per Splunk answers i updated the props.conf on indexer as below. But it didn`t resolve the issue.

[sourcetype]
CHARSET = UTF-16LE
NO_BINARY_CHECK = true

Can someone please assist here.

Re: Issue :- Searching hexadecimal Data from Windows host

gcusello — Tue, 29 Oct 2019 13:48:07 GMT

Hi dvohra,
are you sure that the charset you used is correct?
What do you receive using "CHARSET = auto"?

Ciao.
Giuseppe

Re: Issue :- Searching hexadecimal Data from Windows host

dvohra — Tue, 29 Oct 2019 14:06:26 GMT

No Difference in search results but warning is not there in splunkd.log
If i am creating props.conf at UF also, it is stopping data ingestion also.

Re: Issue :- Searching hexadecimal Data from Windows host

gcusello — Tue, 29 Oct 2019 14:28:48 GMT

Hi dvohra,
props.conf must be located on Indexers or (when present) on Heavy Forwarders, not on Universal Forwarders, with the inly exception of csv and xml.
Ciao.
Giuseppe

Re: Issue :- Searching hexadecimal Data from Windows host

FrankVl — Tue, 29 Oct 2019 18:27:32 GMT

What does your inputs.conf look like on the UF? Is this about the windows event logs, or some other data you're trying to ingest?