https://community.splunk.com/t5/Getting-Data-In/Missing-quot-Message-quot-field/m-p/594910#M103948 <P>We are moving away from using Windows Event Collection to installing the Universal Forwarder on as many Windows machines as we can. I ran into an interesting issue that I don't know how to resolve.<BR />Event 1646, when collected using WEC and then forwarded to Splunk shows this information, which doesn't appear if the same event is sent directly by the UF.<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="wnyricsplunk_0-1650645921382.png" style="width: 748px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19221iF434E1BA8B894F9F/image-dimensions/748x126?v=v2" width="748" height="126" role="button" title="wnyricsplunk_0-1650645921382.png" alt="wnyricsplunk_0-1650645921382.png" /></span></P><P><BR />I copied the stanza used by the UF on the WEC server and deployed it to the machine where the event is generated but I am still not seeing the "extra" data when not using WEC. What am I missing? (Something easy, no doubt). Seems as though I don't see the "Message" field when the event is collected by the UF.<BR /><BR />Thanks in advance.</P> Fri, 22 Apr 2022 16:49:22 GMT wnyricsplunk 2022-04-22T16:49:22Z https://community.splunk.com/t5/Getting-Data-In/Missing-quot-Message-quot-field/m-p/594910#M103948 <P>We are moving away from using Windows Event Collection to installing the Universal Forwarder on as many Windows machines as we can. I ran into an interesting issue that I don't know how to resolve.<BR />Event 1646, when collected using WEC and then forwarded to Splunk shows this information, which doesn't appear if the same event is sent directly by the UF.<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="wnyricsplunk_0-1650645921382.png" style="width: 748px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19221iF434E1BA8B894F9F/image-dimensions/748x126?v=v2" width="748" height="126" role="button" title="wnyricsplunk_0-1650645921382.png" alt="wnyricsplunk_0-1650645921382.png" /></span></P><P><BR />I copied the stanza used by the UF on the WEC server and deployed it to the machine where the event is generated but I am still not seeing the "extra" data when not using WEC. What am I missing? (Something easy, no doubt). Seems as though I don't see the "Message" field when the event is collected by the UF.<BR /><BR />Thanks in advance.</P> Fri, 22 Apr 2022 16:49:22 GMT https://community.splunk.com/t5/Getting-Data-In/Missing-quot-Message-quot-field/m-p/594910#M103948 wnyricsplunk 2022-04-22T16:49:22Z