Let indexer monitor a local file, CHARSET in props.conf works
But if the same file was delivered by an universalforwarder, indexer will eat it as UTF-8, nomatter what was set in indexer's props.conf!
I believe that is set during the input phase on the UF, so you'll need to define the CHARSET there. http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
View solution in original post
CHARSET -> UF's props.conf
SEDCMD,TRANSFORM -> INDEXER's props.conf
a same sourcetype stanza