You can simply ignore the binary check as well using the following props attribute. #****************************************************************************** # Binary file configuration #****************************************************************************** NO_BINARY_CHECK = [true|false] * When set to true, Splunk processes binary files. * Can only be used on the basis of [<sourcetype>], or [source::<source>], not [host::<host>]. * Defaults to false (binary files are ignored). ... View more