Getting Data In

How to edit my configurations to encode French special characters (é à ê è)?

Naaba
New Member

Hi,

I am importing data from Gitlab to Splunk.
The data imported are in French and contains special characters like é, à, è, ê.
Data imported in Splunk are not well encoded.

For example when importing "Définition" I got "D�finition" in Splunk

I tried to configure Splunk (props.conf) with others charsets (UTF-8, latin-1) but nothing works.

Can anyone help me please?

Thank you

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@Naaba - Did the answer below or the comments above help resolve your issue? If yes, please "Accept" the answer below to close out your question. If it's a comment, please mark which comment it was so I can convert it to an answer to be accepted. If you still need help, please add an additional comment with some more feedback. Thanks.

0 Karma

woodcock
Esteemed Legend

Read this first:

https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Configurecharactersetencoding

Now, have you tried this in props.conf:

[host::<YourFrenchHost>]
CHARSET=AUTO

Make sure that the line uses ALL-CAPS.

0 Karma

mdelwaide
Path Finder

Have you tried this encoding in your props.conf ?

[SOURCETYPE]
CHARSET=CP1252

0 Karma

ddrillic
Ultra Champion

You need to figure out the encoding of the source. The following tool helped me many times in the past - Encoding tool

So, you can capture one character from the source data and paste it in the tool's text box. Then you need to see whether it matches one of the encoding the tool supports.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...