Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The description for Event ID ( 1 ) in Source ( RTSearch ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Subtype: FATAL, Module: 'RTSearch', Message: 'Failed to get exclusive lock. Multiple instances of the indexer potentially detected.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is causing the “The description for Event ID ( … ) in Source ( …. ) cannot be found… “?
RTSearch stands for Real Time Search. Look into the last part of the event description for the relevant information about the error. For example, "Failed to get exclusive lock. Multiple instances of the indexer potentially detected" may indicate that a certain volume is in use by another search/indexing service so RTSearch cannot perform its indexing. This might be a temporary condition, however, if the error persists, it may be possible that a faulty application is not releasing the lock on that volume. A reboot may help.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated