Solved: Splunk App for Windows Infrastructure Not Building...

scc00 · ‎05-05-2014

I have the Splunk App for Windows Infrastructure installed and configured. I am getting both windows and AD logs into the app. However, I am missing the following lookups. They are not being built by the Apps Lookup builder. Is there anyway to get these lookups?

EventCodes
SchemaVersionName
LogonTypeName

jbernt_splunk · ‎05-05-2014

Hi there. Those lookups are shipped, not built. You may find them in the original download package for Windows Infrastructure under the lookups folder.

Thanks!
Jeff.

View solution in original post

jbernt_splunk · ‎05-05-2014

Hi there. Those lookups are shipped, not built. You may find them in the original download package for Windows Infrastructure under the lookups folder.

Thanks!
Jeff.

scc00 · ‎05-05-2014

Thanks, Found then within the installation folder.

Splunk App for Windows Infrastructure Not Building All Lookups

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Join the Conversation