How to configure character set encoding for Russian in Splunk?

[templier]

Hello.

Can you help me?
I have a log:
filename":"\u0421\u043e\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u0435 \u043e\u0431 \u043e\u0442\u0441\u0442\u0443\u043f\u043d\u043e\u043c.tif

It's text in Russian. How can I write it in Splunk in Russian?

Thank you.

[dimoobraznii]

Hi!

I also met this problem with russian language.
And I fixed it.

The best option is to make input in preview mode. In advance tab just type:
CHARSET=CP1251

In addition, you can try with ISO-8859-5 and KOI8-R.
Just push "apply" and check result.

[templier]

Hi!

Tried to indicate in props.conf - did not help.

Using online change charset identified charset = koi-7 but indicate this parametr did not help too 😞

[ppablo]

Hi @templier

Have you looked at the documentation on configuring character set encoding in props.conf? http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configurecharactersetencoding

[templier]

Thank you for answer. Maybe it something that should be.