Getting Data In

"Splunk could not get the description for this event"

ChhayaV
Communicator

I am uploading evtx file(eventlog files) into a splunk(v5.0.2) manually without using forwarders.
The events found in the eventlog file after indexing contain the following:

Message=Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt.

I've checked out some similar questions regarding this message. In each case it seems the problem is with a perticular version of the universal forwarder. Im not using any forwarders so that cant be the cause.

Any ideas why splunk displays that message?

Tags (2)
0 Karma

wbfoxii
Communicator

I had four Windows Universal Forwarders that were doing this - they were version 4.3.2. I upgraded to 5.0.1, installing right over the 4.3.2 data and configurations, and after a restart, I was OK.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...