Can 1 sourcetype have 2 CHARSET?

[muizash]

I have a sourcetype named "abc"
It is configured to CHARSET=UTF_8

When I see the events, some events split because of no reason and when i check those particular events, they have encoding of utf-16.

What do I do?

[techiesid]

Hi,

Can you do the below settings and see whether its solving your issue,

[abc]
CHARSET=AUTO

https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Configurecharactersetencoding#Automatically_...