Encoding for forwarded data

andrey2007 · ‎10-27-2011

I have files in CP866 encoding. For indexing them in Splunk i made _russian-CP866.ngram file and changed props.conf this way
[host::]
CHARSET=russian-CP866
What should i do for indexing files in CP866 encoding, which are forwarded by universalforwarder from remote host?

gkanapathy · ‎10-27-2011

CHARSET must be specified on the input, i.e., that config must be on the Universal Forwarder.

andrey2007 · ‎10-27-2011

Where can i do it? In Universal Forwarder there is no ngrams-model folder.

Encoding for forwarded data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation

Encoding for forwarded data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent