I'm looking over an XML log and in the Splunk viewer there are events with long strings of the following:
I can't seem to find this string and/or key combination anywhere within the actual raw log files. Any idea why this might be?
This usually happens when there are hidden .swp files created while you are opening the files by an editor.
Maybe the following can help - Why are some of the events garbled with "\x00"?