I am uploading evtx file(eventlog files) into a splunk(v5.0.2) manually without using forwarders. The events found in the eventlog file after indexing contain the following:
Message=Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt.
I've checked out some similar questions regarding this message. In each case it seems the problem is with a perticular version of the universal forwarder. Im not using any forwarders so that cant be the cause.
Any ideas why splunk displays that message?