Event Log Subscription Server: Splunk could not get the description for this event. Either the component that raises thi

mooree — Tue, 25 Oct 2022 09:30:36 GMT

We recently moved our windows event log service up to Windows 2016 and Splunk 9.0.1 and all Security Auditing events are coming through with the message

Message=Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt.

The Event data looks like this: the data is present but not the usual field descriptions that allows Splunk to work out the structure.

There are many posts, they all date from over 2 years ago, and all refer back to a master post from 2014, (https://community.splunk.com/t5/Getting-Data-In/quot-FormatMessage-error-quot-appears-in-indexed-message-for/m-p/139982#M28765 ) that doesn’t appear to be for current versions of Windows. I have however followed the broad advice in here:

Checked the registry keys – they match the old server
Started Splunk after the event log service (I tried stopping and starting Splunk on a running host to mimic).
Confirmed that the event format is set to Events.

HF is Splunk 9.0.1 / Windows 2016 version 1607 Build 14393.5427 / Splunk Cloud is Version:9.0.2208.3

Re: Event Log Subscription Server: Splunk could not get the description for this event. Either the component that raises

hrawat — Tue, 04 Feb 2025 14:55:40 GMT

Can you try

https://community.splunk.com/t5/Knowledge-Management/Solutions-quot-Splunk-could-not-get-the-description-for-this/td-p/694752

topic Re: Event Log Subscription Server: Splunk could not get the description for this event. Either the component that raises in Getting Data In

Event Log Subscription Server: Splunk could not get the description for this event. Either the component that raises thi

Re: Event Log Subscription Server: Splunk could not get the description for this event. Either the component that raises