Getting Data In

Encoding for forwarded data

andrey2007
Contributor

I have files in CP866 encoding. For indexing them in Splunk i made _russian-CP866.ngram file and changed props.conf this way
[host::]
CHARSET=russian-CP866
What should i do for indexing files in CP866 encoding, which are forwarded by universalforwarder from remote host?

Tags (2)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

CHARSET must be specified on the input, i.e., that config must be on the Universal Forwarder.

0 Karma

andrey2007
Contributor

Where can i do it? In Universal Forwarder there is no ngrams-model folder.

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...