SID not resolve on client server

[servcisco]

Good afternoon! Installed the Splunk_TA_windows application on the server, edited the inputs1. On the SPLUNK server, the logs contain SID instead of name.

[WinEventLog: // Security]
disabled = 0
index = wineventlog
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
renderXml = false

[servcisco]

Putting the setting "renderXml = true" did not help ( where can i see the reason?

[richgalloway]

The event contains what Windows sent.  There may be a setting on the Windows side to control this (but I doubt it) or setting renderXml = true may help.

[servcisco]

Putting the setting "renderXml = true" did not help ( where can i see the reason?

[servcisco]

Putting the setting "renderXml = true" did not help ( where can i see the reason?