Getting Data In

Why am I seeing strange characters for Windows event log fields?

CypherBit
New Member

I'm using Windows Event Forwarding to gather all the needed events on our collector running 2012 R2. Splunk 6.4.0 is installed on this same server.

I've added the data, Monitor\Local Event Logs\ForwardedEvents. All the events are present, but I'm having the following issues:

  • Type is displayed as: Type=윐ᇣp
  • Message is displayed as: Message=윐ᇣp
  • Same for OpCode=윐ᇣp
  • Additionaly: User=NOT_TRANSLATED

I'm very new to Splunk, so try to be as verbose as possible what needs changing and where. I tried using RenderXML = 1, but I still don't see the text, which is displayed correctly when viewed with Event Viewer.

0 Karma
1 Solution

abpe
Path Finder

I had exactly the same issue. To resolve, change the content format of your subscription from Rendered Text to Events:

wecutil ss "subscription name" /cf:Events

View solution in original post

abpe
Path Finder

I had exactly the same issue. To resolve, change the content format of your subscription from Rendered Text to Events:

wecutil ss "subscription name" /cf:Events

View solution in original post

bgaignon
Path Finder

I had the same issue, this solution fixed my problem.
Thanks for the tip.

0 Karma

CypherBit
New Member

Thank you, not sure it does the trick since I pretty much gave up on Splunk and went with Graylog.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!