Splunk Search

Issue :- Searching hexadecimal Data from Windows host

dvohra
Explorer

I have recently deployed Splunk UF on windows machined, installation and setup is successful. But while searching the logs I am getting Hexadecimal data as below

1\x000\x00-\x002\x009\x00-\x001\x009\x00 \x001\x000\x00:\x004\x000\x00:\x001\x009\x00 \x00P\x00I\x00D\x00=\x005\x007\x007\x006\x00 \x00T\x00H\x00D\x00=\x005\x004\x005\x002\x00 \x00U\x00S\x00R\x00=\x00 \x00M\x00S\x00G\x00=\x000\x00 \x00I\x00N\x00F\x00O\x00 \x00a\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00-

As per Splunk answers i updated the props.conf on indexer as below. But it didn`t resolve the issue.

[sourcetype]
CHARSET = UTF-16LE
NO_BINARY_CHECK = true

Can someone please assist here.

0 Karma

FrankVl
Ultra Champion

What does your inputs.conf look like on the UF? Is this about the windows event logs, or some other data you're trying to ingest?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dvohra,
are you sure that the charset you used is correct?
What do you receive using "CHARSET = auto"?

Ciao.
Giuseppe

0 Karma

dvohra
Explorer

No Difference in search results but warning is not there in splunkd.log
If i am creating props.conf at UF also, it is stopping data ingestion also.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dvohra,
props.conf must be located on Indexers or (when present) on Heavy Forwarders, not on Universal Forwarders, with the inly exception of csv and xml.
Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...