Can you help me?
I have a log:
filename":"\u0421\u043e\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u0435 \u043e\u0431 \u043e\u0442\u0441\u0442\u0443\u043f\u043d\u043e\u043c.tif
It's text in Russian. How can I write it in Splunk in Russian?
I also met this problem with russian language.
And I fixed it.
The best option is to make input in preview mode. In advance tab just type:
In addition, you can try with ISO-8859-5 and KOI8-R.
Just push "apply" and check result.
Tried to indicate in props.conf - did not help.
Using online change charset identified charset = koi-7 but indicate this parametr did not help too 😞
Have you looked at the documentation on configuring character set encoding in props.conf? http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configurecharactersetencoding
Thank you for answer. Maybe it something that should be.