Getting Data In

How to ingest binary files to splunk?

Emyamy
Explorer

Hi Splunkers,

How to ingest binary files to splunk? i get error ," ignored due to binary file".

Any help would be appreciated.

Many thanks

Emy

 

 

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk is a text-based platform and so will not ingest binary files.  It makes little sense to do so since Splunk will not be able to search or visualize the binary data 

What is your use case?  Perhaps there is another solution.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Emyamy
Explorer

is there any charset attribute which help converts binary to human readable format?

so i would use it in my props on forwarder.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this answer helps you.  https://community.splunk.com/t5/Getting-Data-In/How-to-Splunk-the-SAP-Security-Audit-Log/m-p/380913

---
If this reply helps you, Karma would be appreciated.
0 Karma

Emyamy
Explorer

Hi @richgalloway 

I'm trying to onboard SAP Audit log files to splunk but it is in binary format. 

i used below props.conf but doesn't seem to be working as expected.

[sap:test]
CHARSET=UTF-16LE
NO_BINARY_CHECK=false
detect_trailing_nulls = false
inputs.conf:

[monitor:///monitoring_path]
index = sap_testindex
sourcetype = sap:test

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...