Getting Data In

Can 1 sourcetype have 2 CHARSET?

muizash
Path Finder

I have a sourcetype named "abc"
It is configured to CHARSET=UTF_8

When I see the events, some events split because of no reason and when i check those particular events, they have encoding of utf-16.

What do I do?

0 Karma

techiesid
SplunkTrust
SplunkTrust

Hi,

Can you do the below settings and see whether its solving your issue,

[abc]
CHARSET=AUTO

https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Configurecharactersetencoding#Automatically_...

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!