Archive2

EventViewer bug? "[EventsViewer module] Input is not proper UTF-8"

Builder

Searching for certain events results in the results pane (where events are usually displayed) shows an error message

[EventsViewer module] Input is not proper UTF-8, indicate encoding ! Bytes: 0x84 0x3C 0x2F 0x66, line 104, column 8

No events are displayed in the results pane, only this error message. The flashtimeline still draws, as does the left field selector bar (and everything else). It is only the event results pane (where events are usually listed) that is affected.

This only occurs with certain specific events - a search that contains a number of events (so that the events viewer is able to display only a subset) may display certain pages correctly when narrowed down by clicking on bars in the flash timeline. So, I suspect it may be related to special characters or something inside specific events that is causing the error to be thrown. Our events in question do have japanese characters in them, but these usually display correctly so it could be a red herring.

This error occurs in Internet Explorer (8.0.6001.18702) and Mozilla Firefox (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729), so I suspect is not browser related and internal to Splunk.

I have narrowed it down 22 lines of logs that contain the problem events, unfortunately I am unable to reproduce them here as they contain sensitive data! Unfortunate.

Are there any known display issues with EventViewer?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

I'm pretty sure it's a bug. Can you open a support case on this? There is also a facility to upload files if you're okay with doing that. Post your case number back here too.

View solution in original post

Path Finder

Hi we are having the same issue

"[EventsViewer module] Input is not proper UTF-8, indicate encoding ! Bytes: 0xA0 0xA0 0xA0 0xA0, line 957, column 31"

Any fixes?

We are on version 4.1.6, it only seems to pop up when we get results from a particular index and time range.

Splunk Employee
Splunk Employee

I'm pretty sure it's a bug. Can you open a support case on this? There is also a facility to upload files if you're okay with doing that. Post your case number back here too.

View solution in original post

Builder

Sure - support case 40410

Screenshot of error has been uploaded to it, but not sample logs due to their sensitive nature. If you REALLY need them, I may be able to get clearance from our Security team, but this can be a real pain.

0 Karma
Reply