All Apps and Add-ons

Eventtype errors using splunk app for windows infrastructure

afolabia
Path Finder

How do I resolve splunk app for windows infrastructure event types errors in a distributed environment? They are all enabled but not producing and results.
Eventtype 'perfmon_windows' does not exist or is disabled.
Eventtype 'wineventlog_windows' does not exist or is disabled.
Eventtype 'wineventlog_security' does not exist or is disabled.

0 Karma
1 Solution

afolabia
Path Finder

Problem solved:
It seems to be more of a permission issue. I access the SH and did a recursive permission change for the Splunk_TA_windows. Check the box for "Replace all child object permissions with inheritable permissions from this object", and restarted splunkd.

View solution in original post

0 Karma

woodcock
Esteemed Legend

These KOs (and other things) are defined in the Splunk_TA_windows app which should always be deployed together with the splunk_app_windows_infrastructure app.

0 Karma

afolabia
Path Finder

Problem solved:
It seems to be more of a permission issue. I access the SH and did a recursive permission change for the Splunk_TA_windows. Check the box for "Replace all child object permissions with inheritable permissions from this object", and restarted splunkd.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi afolabia,
you have three solutions:

  • add the indexes of this app to the default search path for all the interested roles;
  • create a new eventtype (e.g. wineventlog) in which you have only the filter index=wineventlog and the add this eventtype to the others;
  • add to all the eventtypes the filter index=wineventlog.

.

The second solution is longer but, for my idea, prefereable because has best performances.

Ciao.
Giuseppe

0 Karma

afolabia
Path Finder

Thanks, but should i be doing that since all I'm using is the default TA's for windows infrastructure and windows? Also, I do have the eventtype with these included.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi afolabia,
I agree with you and I don't know why in many apps there aren't eventtypes with index.
As I said, you can also put the indexes in the default search path for all the roles you have, but in my installations I always customized eventtypes.
If you want, it's another way to give value to your work!

Ciao.
Giuseppe

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!