Encoding for forwarded data

andrey2007 · ‎10-27-2011

I have files in CP866 encoding. For indexing them in Splunk i made _russian-CP866.ngram file and changed props.conf this way
[host::]
CHARSET=russian-CP866
What should i do for indexing files in CP866 encoding, which are forwarded by universalforwarder from remote host?

gkanapathy · ‎10-27-2011

CHARSET must be specified on the input, i.e., that config must be on the Universal Forwarder.

andrey2007 · ‎10-27-2011

Where can i do it? In Universal Forwarder there is no ngrams-model folder.

Encoding for forwarded data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Join the Conversation

Encoding for forwarded data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Persistent Queue at TcpOut — One of Splunk's Most Practical Features