How to index Mcafee HIPS logs?

[theouhuios]

Hello

Mcafee HIPS logs are written on all laptops and basically contain firewall like data. The issue is HIPS logs are written in unicode text format which Splunk sees as a binary file. Has anyone had any success in trying to index hips logs into splunk?

Thanks

[daniel_goolsby_]

After discovering the event.log was binary-- but the file would seemingly load up fine in notepad, or notepad++.. I discovered the file was actually in a different character set called UCS-2 LE, which according to (http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Configurecharactersetencoding) maps to the utf-16le characterset- that I had to specify that in the props.conf on the forwarder.

[monitor://C:ProgramDataMcAfeeHost Intrusion PreventionEvent.log]
index=
disabled = 0
sourcetype = hipsfw
followTail = 1

in props.conf (still on forwarder)

[hipsfw]
NO_BINARY_CHECK = true
CHARSET = utf-16le