Getting Data In

After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

fpiella
Explorer

I use Splunk in order to get Local Event Log Collection. I get Windows Printer - Operational

with version 6.0.1 there were no problem in getting the username of the user that made the impression

I upgraded to version 6.2.2 last week and now I can not see the username. I only get User: "NOT_TRANSLATED"

Can I make a downgrade to 6.0.1 without no lost of information? In case of uninstall, do I have to configure again everything?

Thanks in advance

1 Solution

fpiella
Explorer

The issue has been solved.

In the inputs.conf file I have added the following parameter and value:

evt_resolve_ad_obj=1

Once I restarted the server, everything worked fine.

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

setting evt_resolve_ad_obj=1 in the event type resolved the issue

0 Karma

fpiella
Explorer

The issue has been solved.

In the inputs.conf file I have added the following parameter and value:

evt_resolve_ad_obj=1

Once I restarted the server, everything worked fine.

fpiella
Explorer

Downgrade has not been necessary. 😉

0 Karma

jkeellogic
Explorer

I have a question to all that upgraded Splunk to 6.2.x.

I have the same problem "NOT_TRANSLATED" but I also have Windows Server 2012 R2 and I get 2 entry for users.
The first line is User=NOT_TRANSLATED"

The second User line I get "domainname\username"
My Version of Splunk 6.2.2

I just want to filter out "NOT_TRANSlATED" from my search command and keep username.

Any ideas?

Jim

0 Karma

masonmorales
Influencer

Stop Splunk, then backup your current Splunk directory first (if possible). You can extract the older release (6.0.1) Splunk package over your existing installation without any loss of data, since the TSIDX files that make up your data will not be affected. Start Splunk again and you should be golden.

0 Karma

mic1024
Path Finder

I Have the same problem in 6.2.0. Some users in sourcetype wineventlog:application come back as NOT_TRANSLATED. I don't want to downgrade though...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...