All Apps and Add-ons

Splunk App for Windows Infrastructure and Missing Empty Lookups

Path Finder

I have a single splunk server environment that i want to use to monitor windows host (which is also a Domain Controller)

I have installed the Splunk App for Windows Infrastructure, the Splunk Supporting Add-on for Active Directory and the Splunk Add-on for Microsoft Windows on the SearchHead/Indexer/DeploymentMaster.

I am then pushing out the Splunk Add-on for Microsoft Windows to the windows host with inputs.conf enabled in the \local folder via the deployment-apps folder.

I run through the setup and configuration of the Splunk App for Windows Infrastructure, build the lookups and migrate to KV store.

Data is being indexed and is searchable from the default search app but none of the dashboards in the Splunk App for Windows Infrastructure app are returning anything.

No errors in the splunkd log on either of the SH or client.

I have a few questions:

  1. Where are the lookups stored that get built?
  2. When i test a lookup e.g. | inputlookup windows_event_details it returns no results - Why arent these lookups populated?

alt text

I do know from version 6 the index stanza has been removed, and therefore all data is going into the index = main

Could this be the issue?

How do i send data to the specific windows indexes? e.g. index=wineventlog

0 Karma


I managed to fix this by changing the renderXml=true to false in every WinEventLog stanza of the inputs.conf.

This is documented here:

All the wineventlog inputs (Windows, AD, and DNS) will have renderXml=true (Xml Format) by default. Make it false for all WinEventLog Inputs as XML data is not supported.

But it is very easy to miss. After I modified the inputs.conf and redistributed it I regenerated the lookups (Tools and Setting > Build Lookups) and all is happy.

0 Karma

Path Finder

thanks jeremyhagand61.

I have opened up a support ticket with Splunk on the lookups problem, they are currently working on it but because its a P3 there hasnt been much traction.

0 Karma


The doco covering the Index config is here:

You either have to add the
index = wineventlog

etc. into your Deployment App (and the app on your Splunk Enterprise install.

Not sure why the lookups are empty. I'm having the same issue.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...