Yes, I tried to use the CHARSET = latin-1 setting, but it dosen't work. I put this in the props.conf under /system/local on the hunk Server.
Hmm, that's strange, does any of the following configs actually get the charset set right? Basically trying to see if there's either another source:: stanza that matches and sets the CHARSET (due to wildcarding) or an automatic sourcetype that overrides your setting
[source::/data/com_data_log*/...] TIME_PREFIX="created": SHOULD_LINEMERGE=false NO_BINARY_CHECK=true CHARSET = Latin-1 # setting priority should ensure that the settings of this stanza are layered on *top* of other matches priority = 100
How about the following?
[source::/data/com_data_log*/...] TIME_PREFIX="created": SHOULD_LINEMERGE=false NO_BINARY_CHECK=true sourcetype = my-sourcetype priority = 100 [my-sourcetype] CHARSET=Latin-1