Why am I seeing strange characters for Windows event log fields?

[CypherBit]

I'm using Windows Event Forwarding to gather all the needed events on our collector running 2012 R2. Splunk 6.4.0 is installed on this same server.

I've added the data, Monitor\Local Event Logs\ForwardedEvents. All the events are present, but I'm having the following issues:

• Type is displayed as: Type=윐ᇣp
• Message is displayed as: Message=윐ᇣp
• Same for OpCode=윐ᇣp
• Additionaly: User=NOT_TRANSLATED

I'm very new to Splunk, so try to be as verbose as possible what needs changing and where. I tried using RenderXML = 1, but I still don't see the text, which is displayed correctly when viewed with Event Viewer.

[abpe · Accepted solution]

I had exactly the same issue. To resolve, change the content format of your subscription from Rendered Text to Events:

wecutil ss "subscription name" /cf:Events

[bgaignon]

I had the same issue, this solution fixed my problem.
Thanks for the tip.

[CypherBit]

Thank you, not sure it does the trick since I pretty much gave up on Splunk and went with Graylog.