topic Re: Eventtype 'msad-rep-errors' does not exist or is disabled in Splunk Enterprise

Eventtype 'msad-rep-errors' does not exist or is disabled

rukshar — Tue, 23 Jul 2024 07:12:46 GMT

I have a dashboard which gives the below error at user end but when i open the dashboard i dont see any error at my end and it perfectly runs fine with the proper result

Error in 'lookup' command: Could not construct lookup 'EventCodes, EventCode, LogName, OUTPUTNEW, desc'. See search.log for more details.
Eventtype 'msad-rep-errors' does not exist or is disabled.

Please help me how to fix this issue.

Re: Eventtype 'msad-rep-errors' does not exist or is disabled

marnall — Tue, 23 Jul 2024 20:30:00 GMT

Could you post the sanitized search from that panel? It likely has a broken reference to a lookup and/or an eventtype.

Re: Eventtype 'msad-rep-errors' does not exist or is disabled

rukshar — Wed, 24 Jul 2024 08:43:26 GMT

eventtype=msad-rep-errors (host="*")|lookup EventCodes EventCode,LogName OUTPUTNEW desc|eval desc=if(isnull(desc),"Unknown EventCode",desc) | stats count by host,Type,EventCode,LogName,desc | lookup DCs_tier0.csv host OUTPUTNEW domain offset_value | search offset_value=1 | search (host="*") (domain="*") | table host domain Type EventCode LogName desc

Re: Eventtype 'msad-rep-errors' does not exist or is disabled

marnall — Wed, 24 Jul 2024 19:30:12 GMT

I suspect the issue lies with the line:

| lookup EventCodes EventCode,LogName OUTPUTNEW desc

I assume this is intended to use a lookup definition called EventCodes. Could you try using inputlookup on EventCodes in a separate search and see which, if any, columns appear?

| inputlookup EventCodes

If there are no results, then either EventCodes does not exist as a lookup definition or you have no permissions to view it.

If there are columns but there are none called "EventCode","LogName" or "dest", then you'll need to adjust those column names in the lookup command.