Why using suppress_text=1 for Windows events logs results in loss of many interesting fields?

[aferchichi]

We have installed a universal forwarder on a DC. In order to reduce the size of the windows logs indexed, we have used the option suppress_text=1 under [WinEvenLog://Security] section in the inputs.conf file on the splunk universal forwarder. However, after setting this option, it happens that many interesting fields have disappeared like the Account_Name, Account_Domain, Logon_Type, etc.
So I have the following questions:
- Are all these fields extracted from the message part?
- What exactly contains the message part?
- What remains exactly when suppress_text=1 option is set?

Thanks for your help

[Ayn · Accepted solution]

You're correct. Many (I would even say most) interesting fields go away when you take away the Message field contents, which is what suppress_text does. To answer what exactly the Message part contains is next to impossible because it depends so much on each event ID what is logged. It's easier to look at it from the other angle of what IS logged apart from the Message field. In Windows Event Viewer terms, "Message" is the stuff you see in the big text box for each event in the Event Viewer. The rest of the fields are what you see below.