Getting Data In

Failed to decode 1945 bytes error: Backup Exec logs

gnovak
Builder

I'm trying to preview a backup exec log in Splunk. The log is in XML. When I preview it in spulnk, I get the error:

Failed to decode 1945 bytes; Failed to decode 2049 bytes

Also the preview makes the entire file into gibberish. It looks like this in splunk preview:

\xFF\xFE<\x00?\x00x\x00m\x00l\x00 \x00v\x00e\x00r\x00s\x00i\x00o\x00n\x00=\x00"\x001\x00.\x000\x00"\x00 \x00e\x00n\x00c\x00o\x00d\x00i\x00n\x00g\x00=\x00"\x00U\x00T\x00F\x00-\x001\x006\x00"\x00?\x00>\x00

\x00
\x00<\x00j\x00o\x00b\x00l\x00o\x00g\x00>\x00<\x00j\x00o\x00b\x00_\x00l\x00o\x00g\x00_\x00v\x00e\x00r\x00s\x00i\x00o\x00n\x00 \x00v\x00e\x00r\x00s\x00i\x00o\x00n\x00=\x00"\x002\x00.\x000\x00"\x00/\x00>\x00<\x00h\x00e\x00a\x00d\x00e\x00r\x00>\x00<\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00
\x00
\x00 \x00 \x00<\x00/\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00<\x00s\x00e\x00r\x00v\x00e\x00r\x00>\x00J\x00o\x00b\x00 \x00s\x00e\x00r\x00v\x00e\x00r\x00:\x00 \x00T\x00A\x00P\x00E\x00B\x00A\x00C\x00K\x00U\x00P\x00
\x00
\x00<\x00/\x00s\x00e\x00r\x00v\x00e\x00r\x00>\x00<\x00n\x00a\x00m\x00e\x00>\x00J\x00o\x00b\x00 \x00n\x00a\x00m\x00e\x00:\x00 \x00W\x00e\x00e\x00k\x00l\x00y\x00 \x00T\x00a\x00p\x00e\x00 \x00B\x00a\x00c\x00k\x00u\x00p\x00
\x00
\x00<\x00/\x00n\x00a\x00m\x00e\x00>\x00<\x00s\x00t\x00a\x00r\x00t\x00_\x00t\x00i\x00m\x00e\x00>\x00J\x00o\x00b\x00 \x00s\x00t\x00a\x00r\x00t\x00e\x00d\x00:\x00 \x00T\x00u\x00e\x00s\x00d\x00a\x00y\x00,\x00 \x00A\x00p\x00r\x00i\x00l\x00 \x000\x009\x00,\x00 \x002\x000\x001\x003\x00 \x00a\x00t\x00 \x005\x00:\x003\x000\x00:\x000\x001\x00 \x00A\x00M\x00
\x00
\x00<\x00/\x00s\x00t\x00a\x00r\x00t\x00_\x00t\x00i\x00m\x00e\x00>\x00<\x00t\x00y\x00p\x00e\x00>\x00J\x00o\x00b\x00 \x00t\x00y\x00p\x00e\x00:\x00 \x00B\x00a\x00c\x00k\x00u\x00p\x00
\x00
\x00<\x00/\x00t\x00y\x00p\x00e\x00>\x00<\x00l\x00o\x00g\x00_\x00n\x00a\x00m\x00e\x00>\x00J\x00o\x00b\x00 \x00L\x00o\x00g\x00:\x00 \x00B\x00E\x00X\x00_\x00T\x00A\x00P\x00E\x00B\x00A\x00C\x00K\x00U\x00P\x00_\x000\x000\x000\x008\x007\x00.\x00x\x00m\x00l\x00
\x00
\x00<\x00/\x00l\x00o\x00g\x00_\x00n\x00a\x00m\x00e\x00>\x00<\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00
\x00
\x00 \x00 \x00<\x00/\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00<\x00/\x00h\x00e\x00a\x00d\x00e\x00r\x00>\x00<\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00
\x00
\x00D\x00r\x00i\x00v\x00e\x00 \x00a\x00n\x00d\x00 \x00m\x00e\x00d\x00i\x00a\x00 \x00m\x00o\x00u\x00n\x00t\x00 \x00r\x00e\x00q\x00u\x00e\x00s\x00t\x00e\x00d\x00:\x00 \x004\x00/\x009\x00/\x002\x000\x001\x003\x00 \x005\x00:\x003\x000\x00:\x000\x001\x00 \x00A\x00M\x00
\x00
\x00<\x00/\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00<\x00m\x00e\x00d\x00i\x00a\x00_\x00d\x00r\x00i\x00v\x00e\x00_\x00a\x00n\x00d\x00_\x00m\x00e\x00d\x00i\x00a\x00_\x00i\x00n\x00f\x00o\x00>\x00<\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00
\x00
\x00D\x00r\x00i\x00v\x00e\x00 \x00a\x00n\x00d\x00 \x00m\x00e\x00d\x00i\x00a\x00 \x00i\x00n\x00f\x00o\x00r\x00m\x00a\x00t\x00i\x00o\x00n\x00 \x00f\x00r\x00o\x00m\x00 \x00m\x00e\x00d\x00i\x00a\x00 \x00m\x00o\x00u\x00n\x00t\x00:\x00 \x004\x00/\x009\x00/\x002\x000\x001\x003\x00 \x005\x00:\x003\x001\x00:\x002\x000\x00 \x00A\x00M\x00
\x00
\x00<\x00/\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00<\x00r\x00o\x00b\x00o\x00t\x00i\x00c\x00_\x00l\x00i\x00b\x00r\x00a\x00r\x00y\x00_\x00n\x00a\x00m\x00e\x00>\x00R\x00o\x00b\x00o\x00t\x00i\x00c\x00 \x00L\x00i\x00b\x00r\x00a\x00r\x00y\x00 \x00N\x00a\x00m\x00e\x00:\x00 \x00Q\x00U\x00A\x00N\x00T\x00U\x00M\x00 \x000\x000\x000\x002\x00
\x00
\x00<\x00/\x00r\x00o\x00b\x00o\x00t\x00i\x00c\x00_\x00l\x00i\x00b\x00r\x00a\x00r\x00y\x00_\x00n\x00a\x00m\x00e\x00>\x00<\x00d\x00r\x00i\x00v\x00e\x00_\x00n\x00a\x00m\x00e\x00>\x00D\x00r\x00i\x00v\x00e\x00 \x00N\x00a\x00m\x00e\x00:\x00 \x00Q\x00U\x00A\x00N\x00T\x00U\x00M\x00 \x000\x000\x000\x001\x00
\x00
\x00<\x00/\x00d\x00r\x00i\x00v\x00e\x00_\x00n\x00a\x00m\x00e\x00>\x00<\x00s\x00l\x00o\x00t\x00>\x00S\x00l\x00o\x00t\x00:\x00 \x002\x00
\x00

Anyone have this happening???????

Tags (1)
0 Karma

vinayakwagh
Engager

the solution which works for me is the 

CHARSET 

attribute in props try to set that to auto. it should work 

0 Karma

gnovak
Builder

Found solution to my own problem. I'm running Backup Exec 2010 and the logs are XML. So....open a command prompt and:

From :

c:\Program Files\Symantec\Backup Exec run:

bemcmd -o31 -l"<output file name.txt>" -s0 -f"<job log.xml>"

Here is an example if you wanted to specify the location for the output file and or the job logs are located in another folder.

bemcmd -o31 -l"BEX_TAPEBACKUP_00091.TXT" s0 -f"C:\Program Files\Symantec\Backup Exec\Data\BEX_TAPEBACKUP_00091.xml"

It will convert the xml to plain text and then you can index it in splunk. It would be easy to schedule this as part of a batch script to convert it to txt.

0 Karma

gnovak
Builder

I'm wondering is it because the xml file is using <> symbols and splunk can't read those?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...