How can i utf8processor warn message, using charse... - Splunk Community

Splunk Enterprise Security

WARN UTF8Processor - Using charset UTF-8, as the monitor is believed over the raw text which may be UTF-16LE - data_source="/var/log/XXX.log", data_host="xxx", data_sourcetype="config"

tooo many sourcetypes make this warnning message
i know, need to change sourcetype in props.conf

Using this,

[config]
CHARSET = UTF-16LE

But i dont wanna do that
just...
I want Splunk to solve it automatically.

So, i found a solution

[config]
CHARSET = AUTO

However, the message still occurs

How can i remove Right way utf8processor warnning msg?

Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...