Splunk Enterprise

Ignoring file due to: binary

mslvrstn
Communicator

A file on my Windows boxes (running the Universal Forwarder) is being ignored because it has some bogus non-ASCII characters in the first few lines. I understand that the way to solve this should be via props.conf:

[my-sourcetype]
NO_BINARY_CHECK = true

but that doesn't seem to work when i configure that on the forwarder.

Someone suggested that this props.conf needs to go on the indexers, but how can that be the case since the message logs on the Forwarder saying it is ignoring the file and so never gets sent to the indexer?

Tags (2)

reedmohn
Communicator

First thought: Did you put it in the right props.conf file? (Sorry, I don't know which one is correct, but I do see that forwarders get cranky if get that stuff wrong...)

0 Karma

Ayn
Legend

Some props.conf settings like NO_BINARY_CHECK are used by Universal and Light forwarders. From
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwardercapabilities

Does not use transforms.conf and does not fully parse incoming data, but the CHARSET, CHECK_FOR_HEADER, NO_BINARY_CHECK, PREFIX_SOURCETYPE, and sourcetype properties from props.conf are used. 

mslvrstn
Communicator

OK, so that explains why it SHOULD work in the forwarders' props.conf, but the real problem is that it doesn't.

I can see NO_BINARY_CHECK in the output of btool props list for my_sourcetype, but when it's restarted, it still logs
08-14-2012 19:46:58.139 +0000 WARN FileClassifierManager - The file 'my_file' is invalid. Reason: binary
08-14-2012 19:46:58.139 +0000 INFO TailingProcessor - Ignoring file 'my_file' due to: binary
for every file.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...