Getting Data In

Overlapping Inputs With Different Charset

Path Finder

Hi, All. I have an overlapping path issue in Windows that I might need some assist on.

I have the contents of two directories which need monitoring (all files have the .log extension):

  • C:\Program Files\MyApp\Client\ConnLog
  • C:\Program Files\MyApp\Client\report

Looks like Splunk has issues with overlapping monitor inputs[1], so I can't monitor the directories with separate input stanzas. The files in the 'report' directory have (for whatever reason) ISO-8859-1 encoding. Splunk requires a separate props.conf directive so the log files are read correctly.

I'm unable to set the input to the parent directory (like "C:\Program Files\MyApp\Client") since the character set change in the report/ directory. Also, there are other files which I don't want to read from the parent directory.

Here's an example (not-really-working) configuration I'm using at the moment.

Have any thoughts on how I will be able to read the contents of both directories as well as read the report directory with the appropriate character set intact?

-- inputs.conf

[monitor://C:\Program Files\MyApp\Client\ConnLog]
sourcetype = conn_log
followTail = 1
crcSalt = <source>

[monitor://C:\Program Files\MyApp\Client\report]
sourcetype = report_log
followTail = 1
crcSalt = <source>

-- props.conf

[source::C:\Program Files\MyApp\Client\report]
CHARSET = ISO-8859-1


Tags (3)
0 Karma


This should work, you can maybe try setting the character set by using sourcetype instead of source:

CHARSET = ISO-8859-1

Make sure that you added the props.conf file on the forwarder, not the indexer.

0 Karma

Path Finder

hi, Thanks for the input.

unfortunately, adding the CHARSET directive into the sourcetype does nothing for me- the entries show up as line noise, just like if the directive wasn't set.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!