- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: splunk thinks text file is binary
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a file a like to upload to splunk with the following data:
72162397 SANTA CRUZ 00 33527710 01/08/2010 0:01:01 28.00 0.23 72162397 SANTA CRUZ 10 70902676 01/08/2010 0:15:53 1.00 0.20 72162397 SANTA CRUZ 00 70011786 01/08/2010 0:34:20 14.00 0.12 72162397 SANTA CRUZ 00 79052362 01/08/2010 0:35:08 127.00 1.05 [rest of file truncated]
But after upload by "Manager » Data inputs » Files & Directories » Add New" with option "Upload a local file"
I got the following error:
==> /opt/splunk/var/log/splunk/splunkd.log <== 09-29-2010 11:50:56.816 WARN FileClassifierManager - The file 'yumolog.txt' is invalid. Reason: binary
why is splunk thinking the file is binary?
Thanks!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could there be an invisible control character at the start of your file? That happened to me one time...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
CHARSET=AUTO
or CHARSET=UTF-8( or whatever charset you need to give)
NO_BINARY_CHECK=true
and remeber to delete the fishbucket
this should fix the issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you run into the same problem if you index the file locally? Or does this only occur if your upload the log file? If you have the file indexed locally, you can force-ably disable the binary check, not that doing so is normally a good idea.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The same problem at the forwarder:
file ////usr/local/rex/azkaban/logs/azkaban.log
///usr/local/rex/azkaban/logs/azkaban.log: ASCII English text
10-03-2012 17:53:21.733 +0000 WARN FileClassifierManager - The file '/usr/local/rex/azkaban/logs/azkaban.log' is invalid. Reason: binary
10-03-2012 17:53:21.734 +0000 INFO TailingProcessor - Ignoring file '/usr/local/rex/azkaban/logs/azkaban.log' due to: binary
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[root@splunk ~]# file yumolog.txt
yumolog.txt: ISO-8859 text, with CRLF line terminators
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same problem loading locally
==> /opt/splunk/var/log/splunk/splunkd.log <==
09-29-2010 18:31:47.730 WARN FileClassifierManager - The file '/root/yumolog.txt' is invalid. Reason: binary
I've also adde a dummy text at the begining with no luck....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could there be an invisible control character at the start of your file? That happened to me one time...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looking into file result let me see that you where rigth. change xA0 to x20 and loade correctly.
Thansk!!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just edited the file with an hex editor and the two first caracters are xA0 (Space character) so no binary data.
Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey
Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...
Monitoring Amazon Elastic Kubernetes Service (EKS)
