Getting Data In

Windows Forwarder reading file just fine while Linux isn't.

bosburn_splunk
Splunk Employee
Splunk Employee

I'm migrating from a Windows server to a Linux machine, and I'm finding that the Linux machine isn't reading a specific file. The file is UTF16-LE per the file command:

[root@bpoundiag01 xml]# file test.xml 
test.xml: Little-endian UTF-16 Unicode text, with very long lines

Why isn't this working?

bosburn_splunk
Splunk Employee
Splunk Employee

This is due to a difference of the default CHARSET setting in the props.conf in Windows vs. Linux.

By default, the CHARSET in Windows is set to AUTO, and will determine which CHARSET to use.

In Linux, it defaults to UTF-8.

The fix is to add the following to the props.conf:

[mysourcetype]
CHARSET=UTF16-LE
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...