Getting Data In

Encoding for forwarded data

andrey2007
Contributor

I have files in CP866 encoding. For indexing them in Splunk i made _russian-CP866.ngram file and changed props.conf this way
[host::]
CHARSET=russian-CP866
What should i do for indexing files in CP866 encoding, which are forwarded by universalforwarder from remote host?

Tags (2)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

CHARSET must be specified on the input, i.e., that config must be on the Universal Forwarder.

0 Karma

andrey2007
Contributor

Where can i do it? In Universal Forwarder there is no ngrams-model folder.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...