Why WinlogBeat cannot render EventID 1111 message?


(Tianlin) #1
  • Version: v5.3.0
  • Operating System: Windows 2003 64bit
  • Steps to Reproduce: When collector EventID 1111 record, it produce“The system cannot find message text for message number 1111 in the message file for C:\WINDOWS\System32\ws03res.dll.”

But splunk render it success.


(Andrew Kroh) #2

For the same event log record with the error (using the the record number to ensure they are the same), could you please share what the Windows Event Viewer shows for this record? And what splunk shows for the record?


(Tianlin) #3

This is result of splunk:


(Andrew Kroh) #4

What does the Windows Event Viewer show for Record Number=1431 in the System log on host=SPCEMC?


(system) #5

This topic was automatically closed after 21 days. New replies are no longer allowed.