After upgrading Splunk from 4.3.3 to 6.2.0, why did a single Universal Forwarder suddenly stop translating local SIDs to Account Names in Windows security logs?

[JeremyHagan]

I have a single UniversalForwarder which has stopped translating local SIDs to account names in the Windows Security log since I upgraded it from 4.3.3 to 6.2.0. Other than that, there have been no changes. Any idea how to troubleshoot this?

The Forwarder is running Windows Server 2008 R2

[JeremyHagan · Accepted solution]

After Splunk 6.2 the setting for evt_resolve_ad_obj defaults to False when it used to be true. I changed this in my WinEventLog:Security stanza and it worked.