Asian language support

[clyde772]

Does Splunk have problem showing Language data from Windows server?

It's Korean data that we are indexing, but after the data got indexed the data got changed to Hex code like string. Any idea How I can prevent Splunk to change the data?

BELOW is actual LOG:

        Information 2010-05-07 인터넷접속 12:59:44   DB Pool

BELOW is after Splunk absorved the data:

        Information 2010-05-07 \xBF\xC0\xC0\xFC 12:59:44    DB Pool

[pingqi]

Dear Sir,

I have the same problem, if it is Traditional Chinese how to set?

I've tried to use EUC-TW,but Windows Event log contains Traditional Chinese, still appears hex code

Thank you!!

[Suda]

Hello,

I think you may need to add a CHARSET parameter in your props.conf. I'm not familier with Korean, sorry. But I faced the same issue in Japanese.

If your Korean character set is "EUC-KR", could you try the following steps?

1. Open or create "props.conf" under $SPLUNK_HOME/etc/system/local.

2. Add the following parameters in the props.conf.

   [your_sourcetype]

   CHARSET=EUC-KR

3. Save it.

4. Search the following command to apply your changes, or restart your splunk.

   | extract reload=t

5. Try to load your new Korean log files with your sourcetype specified above.

I hope it helps you to solve your issue.

Thank you.