Getting Data In

After upgrading a Windows forwarder from Splunk 6.x to 6.3.2, why is the description/message getting cut off for Windows event log data?

anoopambli
Communicator

Seeing this weird problem after upgrading a forwarder on a Windows server from 5.x to 6.3.2

After the upgrade, the Windows event log entries are showing in Splunk without the description/details. Before the upgrade, the description of the event was showing up. Below is an example. The message part is empty in Splunk, but it is there on the source server.

Any ideas?

02/16/2016 10:35:41 AM
LogName=System
SourceName=xxxx
EventCode=28693
EventType=4
ComputerName=xxxxxx
User=xxxxx
Sid=xxxxx
SidType=1
TaskCategory=None
OpCode=None
RecordNumber=5519
Keywords=None
Message=
0 Karma

sloshburch
Ultra Champion

From offline discussion I learned that suppress_text = 0 is set. So the description should be included.

One thought: if you run btool does suppress_text show 0? If not, there could be another config overwriting it.

http://docs.splunk.com/Documentation/Splunk/6.3.3/Troubleshooting/Usebtooltotroubleshootconfiguratio...

Something like: $SPLUNK_HOME/bin/splunk cmd btool inputs list --debug

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!