Importing txt files, how do I configure props.conf so "£" characters do not appear as "\xA0"?

[smudge797]

Below is the format and I want to import. The data is showing \xA0 where there should be a £. Please can you send through some recommended settings for props.conf?

Date:\xA001/12/2015
Description:\xA0CARD PAYMENT TO BEECHCROFT,21.40 GBP, RATE 1.00/GBP ON 28-11-2015                         
Amount:\xA0-21.40\xA0   
Balance:\xA0801.96\xA0

Date:\xA001/12/2015
Description:\xA0CARD PAYMENT TO YESSS ELECTRICAL,240.36 GBP, RATE 1.00/GBP ON 28-11-2015                  
Amount:\xA0-240.36\xA0  
Balance:\xA0823.36\xA0

[sundareshr]

Try this sedcmd in your props to remove xA0 from your file at indexing

SEDCMD =  s/xA0//g

[jkat54]

It's also shows xA0 where I think tabs should be. So it suggests the character encoding on the file is different from that of the system which is consuming the file. Did this file come from UNIX to Windows, if so you can use dosutils in most distros and run the unix2dos command to convert the encoding. You can also use dos2unix if you're going the other way.

Also, have you tried specifying the character set on input in your props.conf?

http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configurecharactersetencoding

[smudge797]

Its part of a bank statement so im not sure about the source. If i remove the xA0 by hand its fine, just annoying additional step.

[frobinson_splun]

Hi, @smudge797,
Have you looked into a sed script for the SEDCMD stanza in props.conf?
http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Propsconf

If you haven't already, you might want to consider a replacement or substitution command here.

Here are some examples based on data anonymization:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/Anonymizedata#Anonymize_data_through_a_sed_sc...

Hope this helps!
@frobinson_splunk