Getting Data In

Error Message Splunk could not get the description for this event

gl_splunkuser
Path Finder

Hello everyone,

I have been receiving the follow message:
Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt. FormatMessage error: Got the following information from this event: <Shows the information>,
the source is WinEventLog:Application. 
But not from all the host have the same issue.

And I don't know how to fix it. 

The version that I used is 7.3.5.

Thanks in advance. 

Labels (3)
0 Karma

Richfez
SplunkTrust
SplunkTrust

There's an extensive troubleshooting section way down at the bottom of this answer:

https://community.splunk.com/t5/Getting-Data-In/quot-FormatMessage-error-quot-appears-in-indexed-mes...

Keep going down until you get to the last post on that one, it's long and will involve work, but should help a lot in isolating this problem.

Remember to toss a karma at that post if it helps!

-Rich

 

 

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...