Splunk App for Windows Infrastructure Not Building All Lookups

[scc00]

I have the Splunk App for Windows Infrastructure installed and configured. I am getting both windows and AD logs into the app. However, I am missing the following lookups. They are not being built by the Apps Lookup builder. Is there anyway to get these lookups?

• EventCodes
• SchemaVersionName
• LogonTypeName

[jbernt_splunk · Accepted solution]

Hi there. Those lookups are shipped, not built. You may find them in the original download package for Windows Infrastructure under the lookups folder.

Thanks!
Jeff.

[scc00]

Thanks, Found then within the installation folder.