Hi, everybody.
I want use splunk to index the data which contain chinese.
Firstly, the base data will send to my spunk universal forwarder.
Then,my universal forwarder will forward the data to my spunk.
The base data char is gb2312.
This is the inputs.conf in universal forwarder.
[udp://514] connection_host = none sourcetype = businesslog
This is the props.conf in spunk.
[businesslog] CHARSET = GB2312
But now the chinese still can`t display correctly.
Wheather i need to define the props.conf in universal forwarder?
Thanks.