In my environment, UF monitors the file and forwards it to Splunk.
It was able to capture the file without problems before,
Due to the version upgrade of software that outputs log that was being monitored,
and the character code is changed from Shift_jis to utf-16LE (with BOM), it is no longer imported.
When checking the internal log of UF, message saying "it was a binary file, so ignored it".
Is this a bug?
Is there any workaround other than updating?
If anyone knows, it would be greatly appreciated if you could tell me.
UF ver: 6.2.0
specify this attribute in props.conf
Also put this
NO_BINARY_CHECK = [true|false] * When set to true, Splunk processes binary files. * Can only be used on the basis of [<sourcetype>], or [source::<source>], not [host::<host>]. * Defaults to false (binary files are ignored). * This setting applies at input time, when data is first read by Splunk. The setting is used on a Splunk system that has configured inputs acquiring the data.
let me know if this helps!
Thank you for answer mayurr98.
As a result of setting like below,
similar events did not recur.
[<sourcetype name>] CHARSET=utf-16le NO_BINARY_CHECK = true
It was very helpful!