https://community.splunk.com/t5/Splunk-Search/How-does-splunk-handle-UTF8-and-non-UTF8-in-the-same-event/m-p/107459#M183378 <P>My client has a conversion program that takes ISO8859 text from round the world and converts it to UTF-8. Another one does the opposite. It is possible to get an event something like </P> <PRE><CODE>01/02/12 01:23:45 converted "ISO-8859-8 characters" to "UTF-8 equivalent" </CODE></PRE> <P>Where "ISO-8859-8 characters" could be Chinese or any foreign characters. How would splunk handle this mixed character set data?<BR /> And before you say try it, I don't have any example data to test yet. </P> Mon, 02 Apr 2012 22:56:25 GMT BobM 2012-04-02T22:56:25Z https://community.splunk.com/t5/Splunk-Search/How-does-splunk-handle-UTF8-and-non-UTF8-in-the-same-event/m-p/107459#M183378 <P>My client has a conversion program that takes ISO8859 text from round the world and converts it to UTF-8. Another one does the opposite. It is possible to get an event something like </P> <PRE><CODE>01/02/12 01:23:45 converted "ISO-8859-8 characters" to "UTF-8 equivalent" </CODE></PRE> <P>Where "ISO-8859-8 characters" could be Chinese or any foreign characters. How would splunk handle this mixed character set data?<BR /> And before you say try it, I don't have any example data to test yet. </P> Mon, 02 Apr 2012 22:56:25 GMT https://community.splunk.com/t5/Splunk-Search/How-does-splunk-handle-UTF8-and-non-UTF8-in-the-same-event/m-p/107459#M183378 BobM 2012-04-02T22:56:25Z https://community.splunk.com/t5/Splunk-Search/How-does-splunk-handle-UTF8-and-non-UTF8-in-the-same-event/m-p/107460#M183379 <P>I don't know, but probably you're going to get one or both strings mis-decoded. Splunk can read different character sets, but I suspect it is going to try to determine one character set for each source file. </P> Tue, 03 Apr 2012 00:14:28 GMT https://community.splunk.com/t5/Splunk-Search/How-does-splunk-handle-UTF8-and-non-UTF8-in-the-same-event/m-p/107460#M183379 gkanapathy 2012-04-03T00:14:28Z