Splunk Enterprise Security
Highlighted

How can i utf8processor warn message, using charser auto?

New Member

WARN UTF8Processor - Using charset UTF-8, as the monitor is believed over the raw text which may be UTF-16LE - datasource="/var/log/XXX.log", datahost="xxx", data_sourcetype="config"

tooo many sourcetypes make this warnning message
i know, need to change sourcetype in props.conf

Using this,

[config]
CHARSET = UTF-16LE

But i dont wanna do that
just...
I want Splunk to solve it automatically.

So, i found a solution

[config]
CHARSET = AUTO

However, the message still occurs

How can i remove Right way utf8processor warnning msg?

0 Karma