Failed to decode 1945 bytes error: Backup Exec logs

[gnovak]

I'm trying to preview a backup exec log in Splunk. The log is in XML. When I preview it in spulnk, I get the error:

Failed to decode 1945 bytes; Failed to decode 2049 bytes

Also the preview makes the entire file into gibberish. It looks like this in splunk preview:

\xFF\xFE<\x00?\x00x\x00m\x00l\x00 \x00v\x00e\x00r\x00s\x00i\x00o\x00n\x00=\x00"\x001\x00.\x000\x00"\x00 \x00e\x00n\x00c\x00o\x00d\x00i\x00n\x00g\x00=\x00"\x00U\x00T\x00F\x00-\x001\x006\x00"\x00?\x00>\x00

\x00
\x00<\x00j\x00o\x00b\x00l\x00o\x00g\x00>\x00<\x00j\x00o\x00b\x00_\x00l\x00o\x00g\x00_\x00v\x00e\x00r\x00s\x00i\x00o\x00n\x00 \x00v\x00e\x00r\x00s\x00i\x00o\x00n\x00=\x00"\x002\x00.\x000\x00"\x00/\x00>\x00<\x00h\x00e\x00a\x00d\x00e\x00r\x00>\x00<\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00
\x00
\x00 \x00 \x00<\x00/\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00<\x00s\x00e\x00r\x00v\x00e\x00r\x00>\x00J\x00o\x00b\x00 \x00s\x00e\x00r\x00v\x00e\x00r\x00:\x00 \x00T\x00A\x00P\x00E\x00B\x00A\x00C\x00K\x00U\x00P\x00
\x00
\x00<\x00/\x00s\x00e\x00r\x00v\x00e\x00r\x00>\x00<\x00n\x00a\x00m\x00e\x00>\x00J\x00o\x00b\x00 \x00n\x00a\x00m\x00e\x00:\x00 \x00W\x00e\x00e\x00k\x00l\x00y\x00 \x00T\x00a\x00p\x00e\x00 \x00B\x00a\x00c\x00k\x00u\x00p\x00
\x00
\x00<\x00/\x00n\x00a\x00m\x00e\x00>\x00<\x00s\x00t\x00a\x00r\x00t\x00_\x00t\x00i\x00m\x00e\x00>\x00J\x00o\x00b\x00 \x00s\x00t\x00a\x00r\x00t\x00e\x00d\x00:\x00 \x00T\x00u\x00e\x00s\x00d\x00a\x00y\x00,\x00 \x00A\x00p\x00r\x00i\x00l\x00 \x000\x009\x00,\x00 \x002\x000\x001\x003\x00 \x00a\x00t\x00 \x005\x00:\x003\x000\x00:\x000\x001\x00 \x00A\x00M\x00
\x00
\x00<\x00/\x00s\x00t\x00a\x00r\x00t\x00_\x00t\x00i\x00m\x00e\x00>\x00<\x00t\x00y\x00p\x00e\x00>\x00J\x00o\x00b\x00 \x00t\x00y\x00p\x00e\x00:\x00 \x00B\x00a\x00c\x00k\x00u\x00p\x00
\x00
\x00<\x00/\x00t\x00y\x00p\x00e\x00>\x00<\x00l\x00o\x00g\x00_\x00n\x00a\x00m\x00e\x00>\x00J\x00o\x00b\x00 \x00L\x00o\x00g\x00:\x00 \x00B\x00E\x00X\x00_\x00T\x00A\x00P\x00E\x00B\x00A\x00C\x00K\x00U\x00P\x00_\x000\x000\x000\x008\x007\x00.\x00x\x00m\x00l\x00
\x00
\x00<\x00/\x00l\x00o\x00g\x00_\x00n\x00a\x00m\x00e\x00>\x00<\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00
\x00
\x00 \x00 \x00<\x00/\x00f\x00i\x00l\x00l\x00e\x00r\x00>\x00<\x00/\x00h\x00e\x00a\x00d\x00e\x00r\x00>\x00<\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00
\x00
\x00D\x00r\x00i\x00v\x00e\x00 \x00a\x00n\x00d\x00 \x00m\x00e\x00d\x00i\x00a\x00 \x00m\x00o\x00u\x00n\x00t\x00 \x00r\x00e\x00q\x00u\x00e\x00s\x00t\x00e\x00d\x00:\x00 \x004\x00/\x009\x00/\x002\x000\x001\x003\x00 \x005\x00:\x003\x000\x00:\x000\x001\x00 \x00A\x00M\x00
\x00
\x00<\x00/\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00<\x00m\x00e\x00d\x00i\x00a\x00_\x00d\x00r\x00i\x00v\x00e\x00_\x00a\x00n\x00d\x00_\x00m\x00e\x00d\x00i\x00a\x00_\x00i\x00n\x00f\x00o\x00>\x00<\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00
\x00
\x00D\x00r\x00i\x00v\x00e\x00 \x00a\x00n\x00d\x00 \x00m\x00e\x00d\x00i\x00a\x00 \x00i\x00n\x00f\x00o\x00r\x00m\x00a\x00t\x00i\x00o\x00n\x00 \x00f\x00r\x00o\x00m\x00 \x00m\x00e\x00d\x00i\x00a\x00 \x00m\x00o\x00u\x00n\x00t\x00:\x00 \x004\x00/\x009\x00/\x002\x000\x001\x003\x00 \x005\x00:\x003\x001\x00:\x002\x000\x00 \x00A\x00M\x00
\x00
\x00<\x00/\x00m\x00e\x00d\x00i\x00a\x00_\x00m\x00o\x00u\x00n\x00t\x00_\x00d\x00a\x00t\x00e\x00>\x00<\x00r\x00o\x00b\x00o\x00t\x00i\x00c\x00_\x00l\x00i\x00b\x00r\x00a\x00r\x00y\x00_\x00n\x00a\x00m\x00e\x00>\x00R\x00o\x00b\x00o\x00t\x00i\x00c\x00 \x00L\x00i\x00b\x00r\x00a\x00r\x00y\x00 \x00N\x00a\x00m\x00e\x00:\x00 \x00Q\x00U\x00A\x00N\x00T\x00U\x00M\x00 \x000\x000\x000\x002\x00
\x00
\x00<\x00/\x00r\x00o\x00b\x00o\x00t\x00i\x00c\x00_\x00l\x00i\x00b\x00r\x00a\x00r\x00y\x00_\x00n\x00a\x00m\x00e\x00>\x00<\x00d\x00r\x00i\x00v\x00e\x00_\x00n\x00a\x00m\x00e\x00>\x00D\x00r\x00i\x00v\x00e\x00 \x00N\x00a\x00m\x00e\x00:\x00 \x00Q\x00U\x00A\x00N\x00T\x00U\x00M\x00 \x000\x000\x000\x001\x00
\x00
\x00<\x00/\x00d\x00r\x00i\x00v\x00e\x00_\x00n\x00a\x00m\x00e\x00>\x00<\x00s\x00l\x00o\x00t\x00>\x00S\x00l\x00o\x00t\x00:\x00 \x002\x00
\x00

Anyone have this happening???????

[vinayakwagh]

the solution which works for me is the 

CHARSET 

attribute in props try to set that to auto. it should work 

[gnovak]

Found solution to my own problem. I'm running Backup Exec 2010 and the logs are XML. So....open a command prompt and:

From :

c:\Program Files\Symantec\Backup Exec run:

bemcmd -o31 -l"<output file name.txt>" -s0 -f"<job log.xml>"

Here is an example if you wanted to specify the location for the output file and or the job logs are located in another folder.

bemcmd -o31 -l"BEX_TAPEBACKUP_00091.TXT" s0 -f"C:\Program Files\Symantec\Backup Exec\Data\BEX_TAPEBACKUP_00091.xml"

It will convert the xml to plain text and then you can index it in splunk. It would be easy to schedule this as part of a batch script to convert it to txt.

[gnovak]

I'm wondering is it because the xml file is using <> symbols and splunk can't read those?