There are only a few attributes in props.conf that matter at the input stage, but they are generally not needed:
- CHARSET = UTF-16LE: When reading data, Splunk has to know the character set used in the log.
- 8859-1 or UTF-8 is handled by the default settings just fine. Some Windows applications write logs in 2-byte little endian, which is indexed as garbage.
- Setting CHARSET = UTF-16LE takes care of the problem. Check out the official documentation for a list of supported encodings.
- NO_BINARY_CHECK = true: If Splunk believes that a file is binary, it will not index the file at all. If you find that you have to change this setting to convince Splunk to read your files, it is likely that the file is in an unexpected character ...
