Splunk Search

sourcetype=WinEventLog:ForwardedEvents missing details

euroccp
Engager

I've an WEC server which is forwarding logs to Splunk. I can see forwarded events coming in with sourcetype=WinEventLog:ForwardedEvents but specific details are missing while they are available in the event itself.

07/25/2018 11:31:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Microsoft Windows security auditing.
ComputerName=***
TaskCategory=Microsoft Windows security auditing.
OpCode=Microsoft Windows security auditing.
RecordNumber=2580614
Keywords=Microsoft Windows security auditing.
Message=Microsoft Windows security auditing.


The description for Event ID 4624 from source Microsoft-Windows-Security-Auditing cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

S-1-5-18
****$
ASP
0x3e7
S-1-5-21-114616164-2729428166-570199722-121507


ASP
0x1fe9df7a
10
User32
Negotiate


{307A5660-29FD-36F7-C074-0310A2D223C5}

-
0
0x125b0
C:\Windows\System32\winlogon.exe
10.18.3.214
50147
%%1833

The locale specific resource for the desired message is not present

Tags (1)
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...