Deployment Architecture

CHARSET does not effect when data is from a universalforwarder?

Contributor

Let indexer monitor a local file, CHARSET in props.conf works
But if the same file was delivered by an universalforwarder, indexer will eat it as UTF-8, nomatter what was set in indexer's props.conf!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

I believe that is set during the input phase on the UF, so you'll need to define the CHARSET there. http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

I believe that is set during the input phase on the UF, so you'll need to define the CHARSET there. http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

View solution in original post

0 Karma

Contributor

thank you!
CHARSET -> UF's props.conf
SEDCMD,TRANSFORM -> INDEXER's props.conf
a same sourcetype stanza
solved

0 Karma