WARN UTF8Processor - Using charset UTF-8, as the monitor is believed over the raw text which may be UTF-16LE - data_source="/var/log/XXX.log", data_host="xxx", data_sourcetype="config"
tooo many sourcetypes make this warnning message
i know, need to change sourcetype in props.conf
Using this,
[config]
CHARSET = UTF-16LE
But i dont wanna do that
just...
I want Splunk to solve it automatically.
So, i found a solution
[config]
CHARSET = AUTO
However, the message still occurs
How can i remove Right way utf8processor warnning msg?