We are trying to upload a text file with German text, but the German umlaute are not recognized
Procedure:
Add data
1. Select Source (file) -> next
2. Set Source Type
(custom)
- line break is working
- charset MS-ANSI German umlaute are not recognized -> next
3. Input settings
...
However, still within the wizard ...
... when we select in the wizard step 3. Input settings back and next ...
... the charset is recognized and German umlaute is recognized!
Monitoring a folder for input does not recognize the charset MS-ANSI and German umlaute at all
CHARSET = MS-ANSI
LINE_BREAKER = (ENDG.*LTIGE BEDINGUNGEN)
NO_BINARY_CHECK = true
TRUNCATE = 1000000
category = Custom
disabled = false
pulldown_type = true
SHOULD_LINEMERGE = false
Anybody encountered this weird issue?
When you create a custom sourcetype via the web UI, it is not automatically distributed (learned this the hard way).
Though it is written to disk, you have to distribute it manually, or via deployment server.
Otherwise, what appears correct in the data preview, is not what you get from ingestion/search.
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Distributesourcetypeconfigurations
When you create a custom sourcetype via the web UI, it is not automatically distributed (learned this the hard way).
Though it is written to disk, you have to distribute it manually, or via deployment server.
Otherwise, what appears correct in the data preview, is not what you get from ingestion/search.
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Distributesourcetypeconfigurations
There was no timestamp defined in the source type,