...which probably needs to be fed in hex so the splunk system won't get a chance to mess with that weird "aring" character.
Assuming the translation below of characters to hex was correct for the target encoding, would either of the following be the proper format? Or is there some other way? (I did notice single characters with the format 0x0c in the conf comments, but that is no guarantee that a field definition like the following would work...)
I would imagine this, like suggested on the other Q, would be HTTP spec %XX encoding? After all this is a RESTful service and I believe the question more surrounds how the REST service interprets the data when it lands via HTTP and not how splunk handles or stores it. Certainly with a GET request (Original REST) the %XX will be supported but I'm not sure about how POST header encoding works in later REST versions that have troublesome tokens etc, possibly the same but may need a prefix? I'm unable to research this right now.
The difference between a friendly URL and un-friendly URL (GET) matters more on the HTTP server than the browser, for example, and the POST data is encoded in to the request header ?somehow?.