How do I set ANSI encoding for a specific index?

[dennisaraujo]

Hello!

I need to use ANSI encoding files, Splunk index configuration files with invalid.
How do I set ANSI encoding for a specific index?

Thanks.

[rafamss · Accepted solution]

Hi dennisaraujo,

Here is how do you configure your splunk: http://docs.splunk.com/Documentation/Splunk/6.0/data/Configurecharactersetencoding and here the full list of enconding that is supported: http://docs.splunk.com/Documentation/Splunk/6.0/data/Configurecharactersetencoding#Comprehensive_lis...

[dennisaraujo]

I set CHARSET = AUTO, but it did not work.
How do I change to ANSI encoding, only the index test?

Thanks.

[rafamss]

Hi dennisaraujo,

By default, Splunk index the file using UTF-8. All configuration about index data must be in props.conf file. Some like this:

[sourcetype::testinput]
CHARSET=ISO-8859-7

The configuration for the index only, is not supported for props.conf, only host, source or sourcetype.