After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

[fpiella]

I use Splunk in order to get Local Event Log Collection. I get Windows Printer - Operational

with version 6.0.1 there were no problem in getting the username of the user that made the impression

I upgraded to version 6.2.2 last week and now I can not see the username. I only get User: "NOT_TRANSLATED"

Can I make a downgrade to 6.0.1 without no lost of information? In case of uninstall, do I have to configure again everything?

Thanks in advance

[rbal_splunk]

setting evt_resolve_ad_obj=1 in the event type resolved the issue

[fpiella · Accepted solution]

The issue has been solved.

In the inputs.conf file I have added the following parameter and value:

evt_resolve_ad_obj=1

Once I restarted the server, everything worked fine.

[fpiella]

Downgrade has not been necessary. 😉

[jkeellogic]

I have a question to all that upgraded Splunk to 6.2.x.

I have the same problem "NOT_TRANSLATED" but I also have Windows Server 2012 R2 and I get 2 entry for users.
The first line is User=NOT_TRANSLATED"

The second User line I get "domainname\username"
My Version of Splunk 6.2.2

I just want to filter out "NOT_TRANSlATED" from my search command and keep username.

Any ideas?

Jim

[masonmorales]

Stop Splunk, then backup your current Splunk directory first (if possible). You can extract the older release (6.0.1) Splunk package over your existing installation without any loss of data, since the TSIDX files that make up your data will not be affected. Start Splunk again and you should be golden.

[mic1024]

I Have the same problem in 6.2.0. Some users in sourcetype wineventlog:application come back as NOT_TRANSLATED. I don't want to downgrade though...