Hello!
I need to use ANSI encoding files, Splunk index configuration files with invalid.
How do I set ANSI encoding for a specific index?
Thanks.
Hi dennisaraujo,
Here is how do you configure your splunk: http://docs.splunk.com/Documentation/Splunk/6.0/data/Configurecharactersetencoding
and here the full list of enconding that is supported: http://docs.splunk.com/Documentation/Splunk/6.0/data/Configurecharactersetencoding#Comprehensive_lis...
Hi dennisaraujo,
Here is how do you configure your splunk: http://docs.splunk.com/Documentation/Splunk/6.0/data/Configurecharactersetencoding
and here the full list of enconding that is supported: http://docs.splunk.com/Documentation/Splunk/6.0/data/Configurecharactersetencoding#Comprehensive_lis...
I set CHARSET = AUTO, but it did not work.
How do I change to ANSI encoding, only the index test?
Thanks.
Hi dennisaraujo,
By default, Splunk index the file using UTF-8. All configuration about index data must be in props.conf
file. Some like this:
[sourcetype::testinput]
CHARSET=ISO-8859-7
The configuration for the index only, is not supported for props.conf
, only host, source or sourcetype
.