Hello, Using Splunk 4.2 (96430) for both a Universal Forwarder and a regular/receiver installation, on Windows Server 2003 R2, both systems same version, service pack, etc. Forwarder is successfully sending to receiver, correctly monitoring selected log files. We want to monitor the Windows Event Log for DNS services, and it is correctly sending that data; however, at the receiver, it is not parsing the DNS Server messages, stating: "Message=Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt." DNS Server is also installed on the receiving system, and monitoring the DNS Server event log properly parses the local DNS events. All other fields (except hostname and record number) are identical, so it recognizes that these are DNS events. How would one make the received (forwarded) DNS events parse to get the proper Message description just like the local DNS events? Both system have DNS server, same windows ver, etc. It seems even though Splunk is receiving the events properly, it won't parse the forwarded events. Thanks- J ... View more