topic Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"? in Getting Data In

After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

fpiella — Wed, 25 Mar 2015 11:22:59 GMT

I use Splunk in order to get Local Event Log Collection. I get Windows Printer - Operational

with version 6.0.1 there were no problem in getting the username of the user that made the impression

I upgraded to version 6.2.2 last week and now I can not see the username. I only get User: "NOT_TRANSLATED"

Can I make a downgrade to 6.0.1 without no lost of information? In case of uninstall, do I have to configure again everything?

Thanks in advance

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

masonmorales — Wed, 25 Mar 2015 13:38:47 GMT

Stop Splunk, then backup your current Splunk directory first (if possible). You can extract the older release (6.0.1) Splunk package over your existing installation without any loss of data, since the TSIDX files that make up your data will not be affected. Start Splunk again and you should be golden.

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

mic1024 — Mon, 11 May 2015 13:44:51 GMT

I Have the same problem in 6.2.0. Some users in sourcetype wineventlog:application come back as NOT_TRANSLATED. I don't want to downgrade though...

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

fpiella — Mon, 28 Sep 2020 19:56:33 GMT

The issue has been solved.

In the inputs.conf file I have added the following parameter and value:

evt_resolve_ad_obj=1

Once I restarted the server, everything worked fine.

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

fpiella — Mon, 11 May 2015 14:09:46 GMT

Downgrade has not been necessary. 😉

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

rbal_splunk — Tue, 29 Sep 2020 06:51:05 GMT

setting evt_resolve_ad_obj=1 in the event type resolved the issue

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

jkeellogic — Tue, 29 Sep 2020 06:55:20 GMT

I have a question to all that upgraded Splunk to 6.2.x.

I have the same problem "NOT_TRANSLATED" but I also have Windows Server 2012 R2 and I get 2 entry for users.
The first line is User=NOT_TRANSLATED"

The second User line I get "domainname\username"
My Version of Splunk 6.2.2

I just want to filter out "NOT_TRANSlATED" from my search command and keep username.

Any ideas?

Jim