Getting Data In

splunk thinks text file is binary

thinman
Explorer

I have a file a like to upload to splunk with the following data:

  72162397   SANTA CRUZ   00   33527710 01/08/2010 0:01:01    28.00 0.23   72162397   SANTA CRUZ   10   70902676 01/08/2010 0:15:53    1.00 0.20   72162397   SANTA CRUZ   00   70011786 01/08/2010 0:34:20    14.00 0.12   72162397   SANTA CRUZ   00   79052362 01/08/2010 0:35:08    127.00 1.05 [rest of file truncated]

But after upload by "Manager » Data inputs » Files & Directories » Add New" with option "Upload a local file"

I got the following error:

==> /opt/splunk/var/log/splunk/splunkd.log <== 09-29-2010 11:50:56.816 WARN FileClassifierManager - The file 'yumolog.txt' is invalid. Reason: binary

why is splunk thinking the file is binary?

Thanks!!

Tags (2)
1 Solution

Branden
Builder

Could there be an invisible control character at the start of your file? That happened to me one time...

View solution in original post

arunsundarm
Engager

CHARSET=AUTO
or CHARSET=UTF-8( or whatever charset you need to give)
NO_BINARY_CHECK=true
and remeber to delete the fishbucket
this should fix the issue

0 Karma

Lowell
Super Champion

Do you run into the same problem if you index the file locally? Or does this only occur if your upload the log file? If you have the file indexed locally, you can force-ably disable the binary check, not that doing so is normally a good idea.

lpolo
Motivator

The same problem at the forwarder:

file ////usr/local/rex/azkaban/logs/azkaban.log

///usr/local/rex/azkaban/logs/azkaban.log: ASCII English text

10-03-2012 17:53:21.733 +0000 WARN FileClassifierManager - The file '/usr/local/rex/azkaban/logs/azkaban.log' is invalid. Reason: binary
10-03-2012 17:53:21.734 +0000 INFO TailingProcessor - Ignoring file '/usr/local/rex/azkaban/logs/azkaban.log' due to: binary

0 Karma

thinman
Explorer

[root@splunk ~]# file yumolog.txt

yumolog.txt: ISO-8859 text, with CRLF line terminators

0 Karma

thinman
Explorer

Same problem loading locally

==> /opt/splunk/var/log/splunk/splunkd.log <==
09-29-2010 18:31:47.730 WARN FileClassifierManager - The file '/root/yumolog.txt' is invalid. Reason: binary

I've also adde a dummy text at the begining with no luck....

0 Karma

Branden
Builder

Could there be an invisible control character at the start of your file? That happened to me one time...

View solution in original post

thinman
Explorer

Looking into file result let me see that you where rigth. change xA0 to x20 and loade correctly.

Thansk!!!!

0 Karma

thinman
Explorer

Just edited the file with an hex editor and the two first caracters are xA0 (Space character) so no binary data.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!