How can i utf8processor warn message, using charse... - Splunk Community

Splunk Enterprise Security

WARN UTF8Processor - Using charset UTF-8, as the monitor is believed over the raw text which may be UTF-16LE - data_source="/var/log/XXX.log", data_host="xxx", data_sourcetype="config"

tooo many sourcetypes make this warnning message
i know, need to change sourcetype in props.conf

Using this,

[config]
CHARSET = UTF-16LE

But i dont wanna do that
just...
I want Splunk to solve it automatically.

So, i found a solution

[config]
CHARSET = AUTO

However, the message still occurs

How can i remove Right way utf8processor warnning msg?

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...