We are trying to ingest Peregrine logs for Asset Manager and we can open the log file up on the windows server and it is all ascii text, however when Splunk ingests it, it comes in as \x00[\x00p\x00r\x00a\x00t\x00i and so on. I modified the input from doing a monitor on the log file to powershell:
[powershell://MonitorConnSlots]
script = . "%SPLUNK_HOME%\etc\apps\FWF_scac_logs\bin\MonitorConnSlots.ps1"
interval = 5,35 * * * *
recursive = false
sourcetype - assetmanagerexport
The powershell script has:
cat c:\Program Files\Peregrine\ACFtp\ACExport\MonitorConnectionSlots.log
The first 2 times it ingested, it did it correctly, but then reverted back to the weird x00 stuff afterwards. We have verified with the Peregrine vendor that the logs written out as ASCII text.
Anyone have any ideas?
