IBM Support

QRadar: Hebrew characters are not parsed correctly when collecting events using WinCollect File Forwarder

Troubleshooting


Problem

Events containing Hebrew characters are not always parsing correctly. This article helps you resolve the issue.

Symptom

If the payload contains values in the Hebrew language, for example, if the data is stored in a CSV format. We can see the Event_Type and Error_Text values contain Hebrew characters, which are not parsed correctly, but showing as unknown characters "????".

Date, System, Event_type, Index, Error_Text
12/1/2023 10:30, plato_elm_arx.nsf, שנבג, FN020200000003296271, שנבגקכעיןחלךצמםפ

QRadar Log Activity:

image-20230220144455-1

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"TS011765161","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
22 March 2023

UID

ibm16956862