We recently moved our windows event log service up to Windows 2016 and Splunk 9.0.1 and all Security Auditing events are coming through with the message
Message=Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt.
The Event data looks like this: the data is present but not the usual field descriptions that allows Splunk to work out the structure.
There are many posts, they all date from over 2 years ago, and all refer back to a master post from 2014, (https://community.splunk.com/t5/Getting-Data-In/quot-FormatMessage-error-quot-appears-in-indexed-mes... ) that doesn’t appear to be for current versions of Windows. I have however followed the broad advice in here:
- Checked the registry keys – they match the old server
- Started Splunk after the event log service (I tried stopping and starting Splunk on a running host to mimic).
- Confirmed that the event format is set to Events.
HF is Splunk 9.0.1 / Windows 2016 version 1607 Build 14393.5427 / Splunk Cloud is Version:9.0.2208.3
