topic Re: Why am I seeing strange characters for Windows event log fields? in Getting Data In

Why am I seeing strange characters for Windows event log fields?

CypherBit — Wed, 27 Apr 2016 20:07:15 GMT

I'm using Windows Event Forwarding to gather all the needed events on our collector running 2012 R2. Splunk 6.4.0 is installed on this same server.

I've added the data, Monitor\Local Event Logs\ForwardedEvents. All the events are present, but I'm having the following issues:

Type is displayed as: Type=윐ᇣp
Message is displayed as: Message=윐ᇣp
Same for OpCode=윐ᇣp
Additionaly: User=NOT_TRANSLATED

I'm very new to Splunk, so try to be as verbose as possible what needs changing and where. I tried using RenderXML = 1, but I still don't see the text, which is displayed correctly when viewed with Event Viewer.

Re: Why am I seeing strange characters for Windows event log fields?

abpe — Fri, 13 May 2016 12:19:06 GMT

I had exactly the same issue. To resolve, change the content format of your subscription from Rendered Text to Events:

wecutil ss "subscription name" /cf:Events

Re: Why am I seeing strange characters for Windows event log fields?

bgaignon — Wed, 15 Jun 2016 09:49:28 GMT

I had the same issue, this solution fixed my problem.
Thanks for the tip.

Re: Why am I seeing strange characters for Windows event log fields?

CypherBit — Wed, 15 Jun 2016 18:49:19 GMT

Thank you, not sure it does the trick since I pretty much gave up on Splunk and went with Graylog.