I'm using Windows Event Forwarding to gather all the needed events on our collector running 2012 R2. Splunk 6.4.0 is installed on this same server.
I've added the data, Monitor\Local Event Logs\ForwardedEvents. All the events are present, but I'm having the following issues:
Type is displayed as: Type=윐ᇣp
Message is displayed as: Message=윐ᇣp
Same for OpCode=윐ᇣp
I'm very new to Splunk, so try to be as verbose as possible what needs changing and where. I tried using RenderXML = 1, but I still don't see the text, which is displayed correctly when viewed with Event Viewer.