Why is Splunk unable to index a converted text file?

[Abilan1]

Hi ,

I have saved the outlook file as a text fie and placed that file into a Splunk monitoring folder. Splunk is just indexing only the 1st line of that text file and for some other converted text files, it is not even indexing a single line. I would like to know if Splunk supports these kind of files or any other way to do this?

Thanks!

[Runals]

I'd look in the internal logs (index=_internal) to see if you can get info from it. Might have to look for things like directory path elements, file name, etc.

[asimagu]

Open it with Notepad++ for example and check that the encoding is UTF-8

[Abilan1]

Hi,

I have checked the file type, it is UTF-8 encoding. Splunk is indexing only 1st line of that file.

Thanks!