Getting Data In

Garbled Events in new Splunk installation on Debian

mpmackenna
New Member

I recently installed Splunk on Debian 6. I created a TCP receiver on port 10000 and installed the Universal forwarder with this command.

msiexec.exe /i \\server\Applications\Splunk\32\splunkforwarder-4.2.2-101277-x86-release.msi DEPLOYMENT_SERVER="splunk:10000" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /quiet  

I am seeing events populate in my server installation but they appear to be garbled nonsense of some sort. What do I need to do to make my Windows events show up correctly on my server.
Here is an example of what I see when I click event and choose to see source.

\u0016\u0003\x00\x00D\u0001\x00\x00@\u0003\x00NB\xE6.*e\xF1\x83\u001cH\xBE\u000b\xA5m۫\xCF=5k\u00041\x95n\x00r\u0012\xFC\u0015pg\xB7\x00\x00\u0018\x009\x008\x005\x003\x002\x00/\x00\u0016\x00\u0013\x00
\x00\u0005\x00\u0004\x00\xFF\u0002\u0001\x00
\u0016\u0003\x00\x00D\u0001\x00\x00@\u0003\x00NB\xE6p\x89WD8=  

Here is a link to a screenshot of my events list.

This post seems to be related but from what I can tell the suggestion is how I have Splunk configured.

Thanks!

Mike

0 Karma

mpmackenna
New Member

Apparently this issue is related to my installer. When I did an installation using the GUI installer and specified the server and such that way in a RDP session instead of running the command, everything for that machine seems to be showing up correctly.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...