All Apps and Add-ons

Splunk App for Windows Infrastructure and Missing Empty Lookups

Path Finder

I have a single splunk server environment that i want to use to monitor windows host (which is also a Domain Controller)

I have installed the Splunk App for Windows Infrastructure, the Splunk Supporting Add-on for Active Directory and the Splunk Add-on for Microsoft Windows on the SearchHead/Indexer/DeploymentMaster.

I am then pushing out the Splunk Add-on for Microsoft Windows to the windows host with inputs.conf enabled in the \local folder via the deployment-apps folder.

I run through the setup and configuration of the Splunk App for Windows Infrastructure, build the lookups and migrate to KV store.

Data is being indexed and is searchable from the default search app but none of the dashboards in the Splunk App for Windows Infrastructure app are returning anything.

No errors in the splunkd log on either of the SH or client.

I have a few questions:

  1. Where are the lookups stored that get built?
  2. When i test a lookup e.g. | inputlookup windows_event_details it returns no results - Why arent these lookups populated?

alt text

I do know from version 6 the index stanza has been removed, and therefore all data is going into the index = main

Could this be the issue?

How do i send data to the specific windows indexes? e.g. index=wineventlog

0 Karma


I managed to fix this by changing the renderXml=true to false in every WinEventLog stanza of the inputs.conf.

This is documented here:

All the wineventlog inputs (Windows, AD, and DNS) will have renderXml=true (Xml Format) by default. Make it false for all WinEventLog Inputs as XML data is not supported.

But it is very easy to miss. After I modified the inputs.conf and redistributed it I regenerated the lookups (Tools and Setting > Build Lookups) and all is happy.

0 Karma

Path Finder

thanks jeremyhagand61.

I have opened up a support ticket with Splunk on the lookups problem, they are currently working on it but because its a P3 there hasnt been much traction.

0 Karma


The doco covering the Index config is here:

You either have to add the
index = wineventlog

etc. into your Deployment App (and the app on your Splunk Enterprise install.

Not sure why the lookups are empty. I'm having the same issue.

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...