Splunk Enterprise

Windows Event Log: Why am I getting a FormatMessage error?

EL
Engager

Hi,

after a Windows system crash of the raid controller, I only get empty reports.  I moved the installation to a VM and everything looked good... But: empty dashboard reports!

Getting data from the windows eventlogs into splunk still works, but most entries have this problem:

Message=Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt.

FormatMessage error...

I checked wecutil gs and I found, it was set to "rendered text" for both of my subscriptions. I've set it back to "events" but still no luck. Restart of the service: not luck.

I'm running SPLUNK Enterprise 8.2.5 on Windows Server 2016.

Any hints are highly appreciated!

Best, EL

Labels (1)
Tags (2)
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...