Getting Data In

I have a customer who's logs are coming out binary I need to change that to text.

nls7010
Path Finder

I have tried putting the following in the props.conf file:

NO_BINARY_CHECK = true

and

NO_BINARY_CHECK = 1

and

CHARSET=AUTO

 

But none of these worked.  I did them in the props.conf file.  But when I look at the splunkd.log file, the Splunk still thinks of the file as binary.  How can I fix this?

 

 

Labels (2)
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I think that your understanding of NO_BINARY_CHECK is incorrect. If you set that to true, then Splunk will process a file with binary data. It doesn't change the data to readable text. From the docs:

NO_BINARY_CHECK = <boolean>
* When set to true, Splunk software processes binary files.
* Can only be used on the basis of [<sourcetype>], or [source::<source>],
  not [host::<host>].
* Default: false (binary files are ignored).
* This setting applies at input time, when data is first read by Splunk
  software, such as on a forwarder that has configured inputs acquiring the
  data.

 

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...