I've an WEC server which is forwarding logs to Splunk. I can see forwarded events coming in with sourcetype=WinEventLog:ForwardedEvents but specific details are missing while they are available in the event itself.
07/25/2018 11:31:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Microsoft Windows security auditing.
ComputerName=***
TaskCategory=Microsoft Windows security auditing.
OpCode=Microsoft Windows security auditing.
RecordNumber=2580614
Keywords=Microsoft Windows security auditing.
Message=Microsoft Windows security auditing.
The description for Event ID 4624 from source Microsoft-Windows-Security-Auditing cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
S-1-5-18
****$
ASP
0x3e7
S-1-5-21-114616164-2729428166-570199722-121507
ASP
0x1fe9df7a
10
User32
Negotiate
{307A5660-29FD-36F7-C074-0310A2D223C5}
-
0
0x125b0
C:\Windows\System32\winlogon.exe
10.18.3.214
50147
%%1833
The locale specific resource for the desired message is not present
