Splunk Search

Issue :- Searching hexadecimal Data from Windows host

dvohra
Explorer

I have recently deployed Splunk UF on windows machined, installation and setup is successful. But while searching the logs I am getting Hexadecimal data as below

1\x000\x00-\x002\x009\x00-\x001\x009\x00 \x001\x000\x00:\x004\x000\x00:\x001\x009\x00 \x00P\x00I\x00D\x00=\x005\x007\x007\x006\x00 \x00T\x00H\x00D\x00=\x005\x004\x005\x002\x00 \x00U\x00S\x00R\x00=\x00 \x00M\x00S\x00G\x00=\x000\x00 \x00I\x00N\x00F\x00O\x00 \x00a\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00-

As per Splunk answers i updated the props.conf on indexer as below. But it didn`t resolve the issue.

[sourcetype]
CHARSET = UTF-16LE
NO_BINARY_CHECK = true

Can someone please assist here.

0 Karma

FrankVl
Ultra Champion

What does your inputs.conf look like on the UF? Is this about the windows event logs, or some other data you're trying to ingest?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dvohra,
are you sure that the charset you used is correct?
What do you receive using "CHARSET = auto"?

Ciao.
Giuseppe

0 Karma

dvohra
Explorer

No Difference in search results but warning is not there in splunkd.log
If i am creating props.conf at UF also, it is stopping data ingestion also.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dvohra,
props.conf must be located on Indexers or (when present) on Heavy Forwarders, not on Universal Forwarders, with the inly exception of csv and xml.
Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...