splunk thinks text file is binary

[thinman]

I have a file a like to upload to splunk with the following data:

  72162397   SANTA CRUZ   00   33527710 01/08/2010 0:01:01    28.00 0.23   72162397   SANTA CRUZ   10   70902676 01/08/2010 0:15:53    1.00 0.20   72162397   SANTA CRUZ   00   70011786 01/08/2010 0:34:20    14.00 0.12   72162397   SANTA CRUZ   00   79052362 01/08/2010 0:35:08    127.00 1.05 [rest of file truncated]

But after upload by "Manager » Data inputs » Files & Directories » Add New" with option "Upload a local file"

I got the following error:

==> /opt/splunk/var/log/splunk/splunkd.log <== 09-29-2010 11:50:56.816 WARN FileClassifierManager - The file 'yumolog.txt' is invalid. Reason: binary

why is splunk thinking the file is binary?

Thanks!!

[arunsundarm]

CHARSET=AUTO
or CHARSET=UTF-8( or whatever charset you need to give)
NO_BINARY_CHECK=true
and remeber to delete the fishbucket
this should fix the issue

[Lowell]

Do you run into the same problem if you index the file locally? Or does this only occur if your upload the log file? If you have the file indexed locally, you can force-ably disable the binary check, not that doing so is normally a good idea.

[lpolo]

The same problem at the forwarder:

file ////usr/local/rex/azkaban/logs/azkaban.log

///usr/local/rex/azkaban/logs/azkaban.log: ASCII English text

10-03-2012 17:53:21.733 +0000 WARN FileClassifierManager - The file '/usr/local/rex/azkaban/logs/azkaban.log' is invalid. Reason: binary
10-03-2012 17:53:21.734 +0000 INFO TailingProcessor - Ignoring file '/usr/local/rex/azkaban/logs/azkaban.log' due to: binary

[thinman]

[root@splunk ~]# file yumolog.txt

yumolog.txt: ISO-8859 text, with CRLF line terminators

[thinman]

Same problem loading locally

==> /opt/splunk/var/log/splunk/splunkd.log <==
09-29-2010 18:31:47.730 WARN FileClassifierManager - The file '/root/yumolog.txt' is invalid. Reason: binary

I've also adde a dummy text at the begining with no luck....

[Branden · Accepted solution]

Could there be an invisible control character at the start of your file? That happened to me one time...

[thinman]

Looking into file result let me see that you where rigth. change xA0 to x20 and loade correctly.

Thansk!!!!

[thinman]

Just edited the file with an hex editor and the two first caracters are xA0 (Space character) so no binary data.