After upgrading a Windows forwarder from Splunk 6.x to 6.3.2, why is the description/message getting cut off for Windows event log data?

[anoopambli]

Seeing this weird problem after upgrading a forwarder on a Windows server from 5.x to 6.3.2

After the upgrade, the Windows event log entries are showing in Splunk without the description/details. Before the upgrade, the description of the event was showing up. Below is an example. The message part is empty in Splunk, but it is there on the source server.

Any ideas?

02/16/2016 10:35:41 AM
LogName=System
SourceName=xxxx
EventCode=28693
EventType=4
ComputerName=xxxxxx
User=xxxxx
Sid=xxxxx
SidType=1
TaskCategory=None
OpCode=None
RecordNumber=5519
Keywords=None
Message=

[sloshburch]

From offline discussion I learned that suppress_text = 0 is set. So the description should be included.

One thought: if you run btool does suppress_text show 0? If not, there could be another config overwriting it.

http://docs.splunk.com/Documentation/Splunk/6.3.3/Troubleshooting/Usebtooltotroubleshootconfiguratio...

Something like: $SPLUNK_HOME/bin/splunk cmd btool inputs list --debug