File upload with user defined charset does not recognized German umlaute

[schomar]

We are trying to upload a text file with German text, but the German umlaute are not recognized

Manual file upload (only works on second attempts)

Procedure:
Add data
1. Select Source (file) -> next
2. Set Source Type
(custom)
- line break is working
- charset MS-ANSI German umlaute are not recognized -> next
3. Input settings
...

However, still within the wizard ...
... when we select in the wizard step 3. Input settings back and next ...
... the charset is recognized and German umlaute is recognized!

automatic file monitoring (does not work either)

Monitoring a folder for input does not recognize the charset MS-ANSI and German umlaute at all

Source type used

CHARSET = MS-ANSI
LINE_BREAKER = (ENDG.*LTIGE BEDINGUNGEN)
NO_BINARY_CHECK = true
TRUNCATE = 1000000
category = Custom
disabled = false
pulldown_type = true
SHOULD_LINEMERGE = false

Anybody encountered this weird issue?

[codebuilder · Accepted solution]

When you create a custom sourcetype via the web UI, it is not automatically distributed (learned this the hard way).
Though it is written to disk, you have to distribute it manually, or via deployment server.

Otherwise, what appears correct in the data preview, is not what you get from ingestion/search.

https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Distributesourcetypeconfigurations

[schomar]

There was no timestamp defined in the source type,