I observe a strange behavior with one of out UniversalForwarders.
First I've added a new logfile on the forwarder with CLI. Events looks good on a search.
After that I'vre removed the monitor and re-added with "-sourcetype cerberus-ftp".
Result: Events are not encoded anymore:
\x00[\x002\x000\x001\x003\x00-\x000\x007\x00-\x000\x004\x00 \x001\x004\x00:\x002\x005\x00:\x003\x003\x00]\x00:\x00C\x00O\x00N\x00N\x00E\x00C\x00T\x00 \x00[\x00 \x00 \x001\x003\x007\x000\x00]\x00 \x00-\x00 \x00T\x00h\x00e\x00 \x00c\x00l\x00i\x00e\x00n\x00t\x00 \x00c\x00l\x00o\x00s\x00e\x00d\x00 \x00t\x00h\x00e\x00 \x00c\x00o\x00n\x00n\x00e\x00c\x00t\x00i\x00o\x00n\x00
I've tried to add "CHARSET = UTF-16" to props.conf. Nothing changed.
If I remove the monitor and add without the sourcetype specified the event is displayed correctly.
Our Setup:
- Windows SplunkForwarder 5.0.2
- Linux Indexer 5.0.1
- Linux SearchHead 5.0.1
Some ideas how to fix the encoding and why the specification of the sourcetype change it?