Encoding for forwarded data

andrey2007 · ‎10-27-2011

I have files in CP866 encoding. For indexing them in Splunk i made _russian-CP866.ngram file and changed props.conf this way
[host::]
CHARSET=russian-CP866
What should i do for indexing files in CP866 encoding, which are forwarded by universalforwarder from remote host?

gkanapathy · ‎10-27-2011

CHARSET must be specified on the input, i.e., that config must be on the Universal Forwarder.

andrey2007 · ‎10-27-2011

Where can i do it? In Universal Forwarder there is no ngrams-model folder.

Encoding for forwarded data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Join the Conversation

Encoding for forwarded data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A