Search with utf-8 codes

[torustad]

In the loggfile:

[#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et låst oppdrag
javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et låst oppdrag

("Kan ikke oppdatere låst oppdrag")

In the search result and in the "show source":

[#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et l\xE5st oppdrag
javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et l\xE5st oppdrag

("Kan ikke oppdatere et l\xE5st oppdrag")

What can I do to get "låst" instead of "l\xE5st", alternatively how can I search for "l\xE5st"?

Thanks and regards,
Bård Tørustad
Research Council of Norway

[dwaddle]

Splunk can be configured for the proper character encoding for an input using the CHARSET option of props.conf. http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

A configuration similar to this may work:

[glassfish]
CHARSET = UTF-8 

Also, review http://www.splunk.com/base/Documentation/4.2.1/Data/Configurecharactersetencoding

Character encoding changes obviously only affect data that is loaded into Splunk after the change is made. It is not retroactive to already-indexed data.