Getting Data In

Why Splunk could not get the description for this event?

hrawat
Splunk Employee
Splunk Employee

Issue happens after windows server is restarted. Restarting splunk universal forwarder fixes the issue.

Either the component that raises this event is not installed

Labels (2)
0 Karma
1 Solution

hrawat
Splunk Employee
Splunk Employee
0 Karma

hrawat
Splunk Employee
Splunk Employee

There are two workarounds.

1. Use 'Delayed Start' for the Splunk Forwarder service. (https://community.splunk.com/t5/Getting-Data-In/Why-quot-FormatMessage-error-quot-appears-in-indexed...). However it's hard to configure thousands of DCs.

2. Configure  interval as cron schedule instead.

interval = [<decimal>|<cron schedule>]

 

[WinEventLog]

interval=* * * * *

 


By default wineventlog interval is 60 sec. That means as soon as splunk is restarted, wineventlog (or any modinput) is immediately started. Subsequently every 60( configured interval) splunk checks if modinput is still running. If not, re-launch modinput.
Instead of setting interval 60 sec, if we use cron schedule to run every minute, then splunk is not going to launch modinput immediately. So essentially the idea is to convert interval setting from decimal to cron schedule to introduce a delay.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...