topic Re: Eventtype errors using splunk app for windows infrastructure in All Apps and Add-ons

Eventtype errors using splunk app for windows infrastructure

afolabia — Wed, 30 Sep 2020 02:36:51 GMT

How do I resolve splunk app for windows infrastructure event types errors in a distributed environment? They are all enabled but not producing and results.
Eventtype 'perfmon_windows' does not exist or is disabled.
Eventtype 'wineventlog_windows' does not exist or is disabled.
Eventtype 'wineventlog_security' does not exist or is disabled.

Re: Eventtype errors using splunk app for windows infrastructure

gcusello — Mon, 14 Oct 2019 12:30:34 GMT

Hi afolabia,
you have three solutions:

add the indexes of this app to the default search path for all the interested roles;
create a new eventtype (e.g. wineventlog) in which you have only the filter index=wineventlog and the add this eventtype to the others;
add to all the eventtypes the filter index=wineventlog.

The second solution is longer but, for my idea, prefereable because has best performances.

Ciao.
Giuseppe

Re: Eventtype errors using splunk app for windows infrastructure

afolabia — Tue, 15 Oct 2019 13:41:30 GMT

Thanks, but should i be doing that since all I'm using is the default TA's for windows infrastructure and windows? Also, I do have the eventtype with these included.

Re: Eventtype errors using splunk app for windows infrastructure

gcusello — Tue, 15 Oct 2019 14:28:47 GMT

Hi afolabia,
I agree with you and I don't know why in many apps there aren't eventtypes with index.
As I said, you can also put the indexes in the default search path for all the roles you have, but in my installations I always customized eventtypes.
If you want, it's another way to give value to your work!

Ciao.
Giuseppe

Re: Eventtype errors using splunk app for windows infrastructure

afolabia — Wed, 30 Sep 2020 02:38:52 GMT

Problem solved:
It seems to be more of a permission issue. I access the SH and did a recursive permission change for the Splunk_TA_windows. Check the box for "Replace all child object permissions with inheritable permissions from this object", and restarted splunkd.

Re: Eventtype errors using splunk app for windows infrastructure

woodcock — Sat, 24 Apr 2021 16:51:20 GMT

These KOs (and other things) are defined in the Splunk_TA_windows app which should always be deployed together with the splunk_app_windows_infrastructure app.