Yes, UF reads props on some occasions such as everything under "Structured Data Header Extraction and configuration" in props.conf.spec and everywhere else you see "this setting is for forwarders" (Just search the page for "forwarder", you'll see them) Character Encoding happens in the Parsing Queue which happens on heavy forwarders and indexers http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Datapipeline http://docs.splunk.com/Documentation/Splunk/6.5.1/Deploy/Componentsofadistributedenvironment To solve your encoding problem, try setting the CHARSET=iso-8859-1 instead. ... View more