Getting Data In

Why UF think my file is binary?

yutaka1005
Builder

In my environment, UF monitors the file and forwards it to Splunk.

It was able to capture the file without problems before,
Due to the version upgrade of software that outputs log that was being monitored,
and the character code is changed from Shift_jis to utf-16LE (with BOM), it is no longer imported.

When checking the internal log of UF, message saying "it was a binary file, so ignored it".

Is this a bug?
Is there any workaround other than updating?

If anyone knows, it would be greatly appreciated if you could tell me.

UF ver: 6.2.0

0 Karma
1 Solution

mayurr98
Super Champion

hey

specify this attribute in props.conf

[host::my-foreign-docs]
CHARSET=AUTO

http://docs.splunk.com/Documentation/Splunk/6.3.3/data/Configurecharactersetencoding#Automatically_s...

Also put this

NO_BINARY_CHECK = [true|false]
* When set to true, Splunk processes binary files.
* Can only be used on the basis of [<sourcetype>], or [source::<source>],
  not [host::<host>].
* Defaults to false (binary files are ignored).
* This setting applies at input time, when data is first read by Splunk.
  The setting is used on a Splunk system that has configured inputs
  acquiring the data.

let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

hey

specify this attribute in props.conf

[host::my-foreign-docs]
CHARSET=AUTO

http://docs.splunk.com/Documentation/Splunk/6.3.3/data/Configurecharactersetencoding#Automatically_s...

Also put this

NO_BINARY_CHECK = [true|false]
* When set to true, Splunk processes binary files.
* Can only be used on the basis of [<sourcetype>], or [source::<source>],
  not [host::<host>].
* Defaults to false (binary files are ignored).
* This setting applies at input time, when data is first read by Splunk.
  The setting is used on a Splunk system that has configured inputs
  acquiring the data.

let me know if this helps!

0 Karma

yutaka1005
Builder

Thank you for answer mayurr98.

As a result of setting like below,
similar events did not recur.

[<sourcetype name>]
CHARSET=utf-16le
NO_BINARY_CHECK = true

It was very helpful!

0 Karma

inventsekar
Super Champion

Good discussions at https://answers.splunk.com/answers/373137/why-does-splunk-think-my-file-is-binary.html

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...