I'm trying to process a ".log" file on a Windows server, and Splunk keeps ignoring it, stating that it's a binary file.
02-26-2016 09:26:54.574 -0500 WARN FileClassifierManager - The file 'C:\Temp\w32tmdebug.log' is invalid. Reason: binary 02-26-2016 09:26:54.574 -0500 INFO TailReader - Ignoring file 'C:\Temp\w32tmdebug.log' due to: binary
I am able to open the file using notepad, so I'm not sure why Splunk thinks it's binary. I also tried adding "NOBINARYCHECK" but that didn't work either. My inputs is below. Any suggestions?
[monitor://C:\Temp\w32tmdebug.log] disabled = false followTail = 0 index = main sourcetype = ntpdebug_log ignoreOlderThan = 2d NO_BINARY_CHECK = true
it's text. I can open and edit the file with notepad. Windows says it's a text file when you look at it in the folder view.
Hi a212830, the NOBINARYCHECK is a props.conf configuration, and so you will want to create a stanza in props like:
[source::C:\Temp\w32tmdebug.log] NO_BINARY_CHECK = true
However, I'd take a closer look at this log file. The encoding is probably screwy and therefore is throwing off Splunk. Windows logs can be tricky like that.
Please let me know if this helps!
Is your file using something other than the UTF-8 or ASCII character sets? For instance, I had a similar problem with some logs encoded in UTF-16 and had to specify it explicitly.
Interestingly, the Out-Of-The-Box props.conf has a number of NOBINARYCHECK = 1 within it, such as -
KVMODE = multiWinNetMonMk
NOBINARYCHECK = 1
pulldown_type = 0
I love all the answers and ideas posted here. I think I've come across this in the past and the root cause was the same as other folks on this thread have posted.
Here's some details on what I remember I did to determine if encoding was the cause:
I hope it turns out to be as simple as this. Crossing my fingers.
Here's another approach for determining the file character set: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Garbledevents
So in this case, FTP the file from Windows to a Unix system to use the
file command as a way to determine the character set.