CHARSET does not effect when data is from a universalforwarder?

[crazyeva]

Let indexer monitor a local file, CHARSET in props.conf works
But if the same file was delivered by an universalforwarder, indexer will eat it as UTF-8, nomatter what was set in indexer's props.conf!

[martin_mueller · Accepted solution]

I believe that is set during the input phase on the UF, so you'll need to define the CHARSET there. http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

[crazyeva]

thank you!
CHARSET -> UF's props.conf
SEDCMD,TRANSFORM -> INDEXER's props.conf
a same sourcetype stanza
solved