What is an example of a proper configuration for CHARSET within props.conf?
A.
[host: : server. splunk. com]CHARSET = BIG5
B.
[index: :main]CHARSET = BIG5
C.
[sourcetype: : son]CHARSET = BIG5
D.
[source: : /var/log/ splunk]CHARSET = BIG5
The Answer Is:
A
This question includes an explanation.
Explanation:
According to the Splunk documentation1, to manually specify a character set for an input, you need to set the CHARSET key in the props.conf file. You can specify the character set by host, source, or sourcetype, but not by index.