Getting Data In

Monitoing remote file server log have \x00\

kennethyeung
New Member

Usually first few line have issue, I suspect the Application still writing the log to the log file but splunk try to read the log file

Can we setup splunk to wait ?

Tags (1)
0 Karma

ddrillic
Ultra Champion

The following worked for me a couple of times - How do I remove \x00 characters from my log message?

0 Karma

dkeck
Influencer

Hi,

you can not (easily) delay ingestion of data, but see this post for help:
https://answers.splunk.com/answers/705953/can-you-delay-a-universal-forwarder-from-ingesting.html#an...

0 Karma

kennethyeung
New Member

Thanks, my splunk is Windows Server, and the log file we didnt install the agent to forward the log.

we just monitor it by file share

0 Karma

dkeck
Influencer

Doesn´t matter if forwarder or fileshare monitor.

0 Karma

sdchakraborty
Contributor

Hi,

Can you give more details about your problem. An example probably.

Sid

0 Karma

kennethyeung
New Member

example, in the index, i will see below event
1 . \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ ................................................
2 .#Software: Microsoft Exchange Server

0 Karma

ddrillic
Ultra Champion

Right. If you look at the url I posted you can see the solution -

Automatically at parsing ("indexing") time for any new data, in props.conf -

    [yoursourcetype]
    SEDCMD-remove_nulls = s/\\x00//g
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!