Splunk Search

Issue :- Searching hexadecimal Data from Windows host

dvohra
Explorer

I have recently deployed Splunk UF on windows machined, installation and setup is successful. But while searching the logs I am getting Hexadecimal data as below

1\x000\x00-\x002\x009\x00-\x001\x009\x00 \x001\x000\x00:\x004\x000\x00:\x001\x009\x00 \x00P\x00I\x00D\x00=\x005\x007\x007\x006\x00 \x00T\x00H\x00D\x00=\x005\x004\x005\x002\x00 \x00U\x00S\x00R\x00=\x00 \x00M\x00S\x00G\x00=\x000\x00 \x00I\x00N\x00F\x00O\x00 \x00a\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00-

As per Splunk answers i updated the props.conf on indexer as below. But it didn`t resolve the issue.

[sourcetype]
CHARSET = UTF-16LE
NO_BINARY_CHECK = true

Can someone please assist here.

0 Karma

FrankVl
Ultra Champion

What does your inputs.conf look like on the UF? Is this about the windows event logs, or some other data you're trying to ingest?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dvohra,
are you sure that the charset you used is correct?
What do you receive using "CHARSET = auto"?

Ciao.
Giuseppe

0 Karma

dvohra
Explorer

No Difference in search results but warning is not there in splunkd.log
If i am creating props.conf at UF also, it is stopping data ingestion also.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dvohra,
props.conf must be located on Indexers or (when present) on Heavy Forwarders, not on Universal Forwarders, with the inly exception of csv and xml.
Ciao.
Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!