Getting Data In
Highlighted

After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

Explorer

I use Splunk in order to get Local Event Log Collection. I get Windows Printer - Operational

with version 6.0.1 there were no problem in getting the username of the user that made the impression

I upgraded to version 6.2.2 last week and now I can not see the username. I only get User: "NOT_TRANSLATED"

Can I make a downgrade to 6.0.1 without no lost of information? In case of uninstall, do I have to configure again everything?

Thanks in advance

Highlighted

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

Influencer

Stop Splunk, then backup your current Splunk directory first (if possible). You can extract the older release (6.0.1) Splunk package over your existing installation without any loss of data, since the TSIDX files that make up your data will not be affected. Start Splunk again and you should be golden.

0 Karma
Highlighted

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

Path Finder

I Have the same problem in 6.2.0. Some users in sourcetype wineventlog:application come back as NOT_TRANSLATED. I don't want to downgrade though...

0 Karma
Highlighted

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

Explorer

The issue has been solved.

In the inputs.conf file I have added the following parameter and value:

evtresolvead_obj=1

Once I restarted the server, everything worked fine.

View solution in original post

Highlighted

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

Explorer

Downgrade has not been necessary. 😉

0 Karma
Highlighted

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

Explorer

I have a question to all that upgraded Splunk to 6.2.x.

I have the same problem "NOTTRANSLATED" but I also have Windows Server 2012 R2 and I get 2 entry for users.
The first line is User=NOT
TRANSLATED"

The second User line I get "domainname\username"
My Version of Splunk 6.2.2

I just want to filter out "NOT_TRANSlATED" from my search command and keep username.

Any ideas?

Jim

0 Karma
Highlighted

Re: After upgrading to Splunk 6.2.2 from 6.0.1, why do Windows event logs now show users as "NOT_TRANSLATED"?

Splunk Employee
Splunk Employee

setting evtresolvead_obj=1 in the event type resolved the issue

0 Karma