Problems with parsing Windows Event Log and CIM Model

[KrumTym]

In some cases, I encounter problems with parsing data using CIM datamodel on windows event log data.

For example,  when searching for deleted and created user accounts using datamodel:

| from datamodel:"Change"."Account_Management" | search (action="created" OR action="deleted")

"User" field is calulated correctly for "created" 4720 events. 

This field calculation does not work correctly for 4726 events, where user and source user fields are returned as unknwon (even though they are present in raw log data). 

I am using Splunk TA for windows to ingest data. 

What may be the cause of this behavior? 

[richgalloway]

If a datamodel returns "unknown" for a field value it's because the expected field(s) were not found.  Perhaps the 4726 events are not tagged correctly.

[KrumTym]

Unfortunately, all the fields required are present in the raw event. The tags were also produced correctly. 

In this (quite old) thread https://community.splunk.com/t5/Splunk-Search/Define-user-field-in-Security-Essentials/m-p/312738 I've found an issue somehow connected to mine, as mine problems are also connected to the user and src_user field extraction and my AD server is also in a non-english language.

Has anyone found the underlying issue?