Monitoring Splunk

How to get ASCII log file to ingest as plain text from windows 2016 server

AndreaSimon
New Member

We are trying to ingest Peregrine logs for Asset Manager and we can open the log file up on the windows server and it is all ascii text, however when Splunk ingests it, it comes in as \x00[\x00p\x00r\x00a\x00t\x00i and so on. I modified the input from doing a monitor on the log file to powershell:
[powershell://MonitorConnSlots]
script = . "%SPLUNK_HOME%\etc\apps\FWF_scac_logs\bin\MonitorConnSlots.ps1"
interval = 5,35 * * * *
recursive = false
sourcetype - assetmanagerexport

The powershell script has:
cat c:\Program Files\Peregrine\ACFtp\ACExport\MonitorConnectionSlots.log

The first 2 times it ingested, it did it correctly, but then reverted back to the weird x00 stuff afterwards. We have verified with the Peregrine vendor that the logs written out as ASCII text.

Anyone have any ideas?

Tags (1)
0 Karma

laurie_gellatly
Communicator

Looks like it might be a CHARSET issue.
Have you set CHARSET in props.conf for this sourcetype?
Could it be UTF-16?
I've seen a similar problem (though I think the BOM was different) when dealing with Splunk conf files under windows.
I had to force the encoding when opening the files in Python.

...Laurie:{)

0 Karma

AndreaSimon
New Member

Forgot to add, this file only writes out at the top and bottom of every hour incase that makes a difference.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...