Getting Data In

Garbled Events in new Splunk installation on Debian

mpmackenna
New Member

I recently installed Splunk on Debian 6. I created a TCP receiver on port 10000 and installed the Universal forwarder with this command.

msiexec.exe /i \\server\Applications\Splunk\32\splunkforwarder-4.2.2-101277-x86-release.msi DEPLOYMENT_SERVER="splunk:10000" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /quiet  

I am seeing events populate in my server installation but they appear to be garbled nonsense of some sort. What do I need to do to make my Windows events show up correctly on my server.
Here is an example of what I see when I click event and choose to see source.

\u0016\u0003\x00\x00D\u0001\x00\x00@\u0003\x00NB\xE6.*e\xF1\x83\u001cH\xBE\u000b\xA5m۫\xCF=5k\u00041\x95n\x00r\u0012\xFC\u0015pg\xB7\x00\x00\u0018\x009\x008\x005\x003\x002\x00/\x00\u0016\x00\u0013\x00
\x00\u0005\x00\u0004\x00\xFF\u0002\u0001\x00
\u0016\u0003\x00\x00D\u0001\x00\x00@\u0003\x00NB\xE6p\x89WD8=  

Here is a link to a screenshot of my events list.

This post seems to be related but from what I can tell the suggestion is how I have Splunk configured.

Thanks!

Mike

0 Karma

mpmackenna
New Member

Apparently this issue is related to my installer. When I did an installation using the GUI installer and specified the server and such that way in a RDP session instead of running the command, everything for that machine seems to be showing up correctly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...