UTF8Processor warning message

[ollie920049]

Hi there,

I have CHARSET = UTF-16LE enforced in props.conf for all universal forwarders.

For UniForwarder -> Indexer this all works correctly. However, for UniForwarder -> HeavyForwareder -> Indexer this causes an WARN log entry for each processed event on the heavy forwarder:

12-04-2014 15:27:48.026 +0000 WARN UTF8Processor - Using charset UTF-8, as the monitor is believed over the raw text which may be UTF-16LE

Any ideas what I can do to fix this? It's currently being indexed correctly, but generating 1000's of WARN's a minute.

Thanks in advance

[gavsdavs_GR]

Your HF is parsing, whatever it is you have set up for the sourcetype on the indexer needs to be on the HF too.