Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- File upload with user defined charset does not rec...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We are trying to upload a text file with German text, but the German umlaute are not recognized
Manual file upload (only works on second attempts)
Procedure:
Add data
1. Select Source (file) -> next
2. Set Source Type
(custom)
- line break is working
- charset MS-ANSI German umlaute are not recognized -> next
3. Input settings
...
However, still within the wizard ...
... when we select in the wizard step 3. Input settings back and next ...
... the charset is recognized and German umlaute is recognized!
automatic file monitoring (does not work either)
Monitoring a folder for input does not recognize the charset MS-ANSI and German umlaute at all
Source type used
CHARSET = MS-ANSI
LINE_BREAKER = (ENDG.*LTIGE BEDINGUNGEN)
NO_BINARY_CHECK = true
TRUNCATE = 1000000
category = Custom
disabled = false
pulldown_type = true
SHOULD_LINEMERGE = false
Anybody encountered this weird issue?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you create a custom sourcetype via the web UI, it is not automatically distributed (learned this the hard way).
Though it is written to disk, you have to distribute it manually, or via deployment server.
Otherwise, what appears correct in the data preview, is not what you get from ingestion/search.
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Distributesourcetypeconfigurations
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you create a custom sourcetype via the web UI, it is not automatically distributed (learned this the hard way).
Though it is written to disk, you have to distribute it manually, or via deployment server.
Otherwise, what appears correct in the data preview, is not what you get from ingestion/search.
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Distributesourcetypeconfigurations
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There was no timestamp defined in the source type,
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Community Badges!
How to find the worst searches in your Splunk environment and how to fix them
Share Your Feedback: On Admin Config Service (ACS)!
