https://community.splunk.com/t5/Splunk-Search/Search-with-utf-8-codes/m-p/104091#M183139 <P>Splunk can be configured for the proper character encoding for an input using the <CODE>CHARSET</CODE> option of <CODE>props.conf</CODE>. <A href="http://www.splunk.com/base/Documentation/latest/Admin/Propsconf">http://www.splunk.com/base/Documentation/latest/Admin/Propsconf</A></P> <P>A configuration similar to this may work:</P> <PRE><CODE>[glassfish] CHARSET = UTF-8 </CODE></PRE> <P>Also, review <A href="http://www.splunk.com/base/Documentation/4.2.1/Data/Configurecharactersetencoding">http://www.splunk.com/base/Documentation/4.2.1/Data/Configurecharactersetencoding</A></P> <P>Character encoding changes obviously only affect data that is loaded into Splunk after the change is made. It is not retroactive to already-indexed data.</P> Wed, 18 May 2011 19:15:17 GMT dwaddle 2011-05-18T19:15:17Z https://community.splunk.com/t5/Splunk-Search/Search-with-utf-8-codes/m-p/104090#M183138 <P>In the loggfile:</P> <P>[#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et låst oppdrag<BR /> javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et låst oppdrag</P> <P>("Kan ikke oppdatere låst oppdrag")</P> <P>In the search result and in the "show source":</P> <P>[#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et l\xE5st oppdrag<BR /> javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et l\xE5st oppdrag</P> <P>("Kan ikke oppdatere et l\xE5st oppdrag")</P> <P>What can I do to get "låst" instead of "l\xE5st", alternatively how can I search for "l\xE5st"?</P> <P>Thanks and regards,<BR /> Bård Tørustad<BR /> Research Council of Norway</P> Mon, 28 Sep 2020 09:34:44 GMT https://community.splunk.com/t5/Splunk-Search/Search-with-utf-8-codes/m-p/104090#M183138 torustad 2020-09-28T09:34:44Z https://community.splunk.com/t5/Splunk-Search/Search-with-utf-8-codes/m-p/104091#M183139 <P>Splunk can be configured for the proper character encoding for an input using the <CODE>CHARSET</CODE> option of <CODE>props.conf</CODE>. <A href="http://www.splunk.com/base/Documentation/latest/Admin/Propsconf">http://www.splunk.com/base/Documentation/latest/Admin/Propsconf</A></P> <P>A configuration similar to this may work:</P> <PRE><CODE>[glassfish] CHARSET = UTF-8 </CODE></PRE> <P>Also, review <A href="http://www.splunk.com/base/Documentation/4.2.1/Data/Configurecharactersetencoding">http://www.splunk.com/base/Documentation/4.2.1/Data/Configurecharactersetencoding</A></P> <P>Character encoding changes obviously only affect data that is loaded into Splunk after the change is made. It is not retroactive to already-indexed data.</P> Wed, 18 May 2011 19:15:17 GMT https://community.splunk.com/t5/Splunk-Search/Search-with-utf-8-codes/m-p/104091#M183139 dwaddle 2011-05-18T19:15:17Z