i have download my logs, from my server ,which is encode by "GBK" or GB2312' to my desktop in my computer, and getting the logs data in the platform by using the adding-data function in the splunk web-ui .the version of my splunk enterprise is 8.2.1. when i setting the sourcetype in the process of adding the data , i choose the charset 'gb2312', and then to search the log in splunk, it correctly displayed. however, when i use the inputs and outputs conf in splunk universal forwader to send the logs to the splunk platform,it correctly displayed but hava some garbled code.
i have followed the suggsetion Solved: Can splunk support GBK? - Splunk Community but it can not solved my problem. the below is my configuration in my server and UF.
server:
directory:/opt/splunk/etc/system/local/props.conf
[mysourcetype]
CHARSET = GB2312
UF:
directory:/opt/splunk/etc/apps/search/local/inputs.conf
[default]
host = 10.31.xx.xx
[monitor:///home/abc/log/20230921/*.log]
index = abcd
sourcetype = mysourcetype
disabled = false
