Deployment Architecture

CHARSET does not effect when data is from a universalforwarder?

crazyeva
Contributor

Let indexer monitor a local file, CHARSET in props.conf works
But if the same file was delivered by an universalforwarder, indexer will eat it as UTF-8, nomatter what was set in indexer's props.conf!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I believe that is set during the input phase on the UF, so you'll need to define the CHARSET there. http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I believe that is set during the input phase on the UF, so you'll need to define the CHARSET there. http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

0 Karma

crazyeva
Contributor

thank you!
CHARSET -> UF's props.conf
SEDCMD,TRANSFORM -> INDEXER's props.conf
a same sourcetype stanza
solved

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...