Getting Data In

splunk thinks text file is binary

thinman
Explorer

I have a file a like to upload to splunk with the following data:

  72162397   SANTA CRUZ   00   33527710 01/08/2010 0:01:01    28.00 0.23   72162397   SANTA CRUZ   10   70902676 01/08/2010 0:15:53    1.00 0.20   72162397   SANTA CRUZ   00   70011786 01/08/2010 0:34:20    14.00 0.12   72162397   SANTA CRUZ   00   79052362 01/08/2010 0:35:08    127.00 1.05 [rest of file truncated]

But after upload by "Manager » Data inputs » Files & Directories » Add New" with option "Upload a local file"

I got the following error:

==> /opt/splunk/var/log/splunk/splunkd.log <== 09-29-2010 11:50:56.816 WARN FileClassifierManager - The file 'yumolog.txt' is invalid. Reason: binary

why is splunk thinking the file is binary?

Thanks!!

Tags (2)
1 Solution

Branden
Builder

Could there be an invisible control character at the start of your file? That happened to me one time...

View solution in original post

arunsundarm
Engager

CHARSET=AUTO
or CHARSET=UTF-8( or whatever charset you need to give)
NO_BINARY_CHECK=true
and remeber to delete the fishbucket
this should fix the issue

0 Karma

Lowell
Super Champion

Do you run into the same problem if you index the file locally? Or does this only occur if your upload the log file? If you have the file indexed locally, you can force-ably disable the binary check, not that doing so is normally a good idea.

lpolo
Motivator

The same problem at the forwarder:

file ////usr/local/rex/azkaban/logs/azkaban.log

///usr/local/rex/azkaban/logs/azkaban.log: ASCII English text

10-03-2012 17:53:21.733 +0000 WARN FileClassifierManager - The file '/usr/local/rex/azkaban/logs/azkaban.log' is invalid. Reason: binary
10-03-2012 17:53:21.734 +0000 INFO TailingProcessor - Ignoring file '/usr/local/rex/azkaban/logs/azkaban.log' due to: binary

0 Karma

thinman
Explorer

[root@splunk ~]# file yumolog.txt

yumolog.txt: ISO-8859 text, with CRLF line terminators

0 Karma

thinman
Explorer

Same problem loading locally

==> /opt/splunk/var/log/splunk/splunkd.log <==
09-29-2010 18:31:47.730 WARN FileClassifierManager - The file '/root/yumolog.txt' is invalid. Reason: binary

I've also adde a dummy text at the begining with no luck....

0 Karma

Branden
Builder

Could there be an invisible control character at the start of your file? That happened to me one time...

thinman
Explorer

Looking into file result let me see that you where rigth. change xA0 to x20 and loade correctly.

Thansk!!!!

0 Karma

thinman
Explorer

Just edited the file with an hex editor and the two first caracters are xA0 (Space character) so no binary data.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...