Splunk App for Windows Infrastructure and Missing Empty Lookups

[davidjohnbecket]

I have a single splunk server environment that i want to use to monitor windows host (which is also a Domain Controller)

I have installed the Splunk App for Windows Infrastructure, the Splunk Supporting Add-on for Active Directory and the Splunk Add-on for Microsoft Windows on the SearchHead/Indexer/DeploymentMaster.

I am then pushing out the Splunk Add-on for Microsoft Windows to the windows host with inputs.conf enabled in the \local folder via the deployment-apps folder.

I run through the setup and configuration of the Splunk App for Windows Infrastructure, build the lookups and migrate to KV store.

Data is being indexed and is searchable from the default search app but none of the dashboards in the Splunk App for Windows Infrastructure app are returning anything.

No errors in the splunkd log on either of the SH or client.

I have a few questions:

1. Where are the lookups stored that get built?
2. When i test a lookup e.g. | inputlookup windows_event_details it returns no results - Why arent these lookups populated?

I do know from version 6 the index stanza has been removed, and therefore all data is going into the index = main

Could this be the issue?

How do i send data to the specific windows indexes? e.g. index=wineventlog

[jeremyhagand61]

I managed to fix this by changing the renderXml=true to false in every WinEventLog stanza of the inputs.conf.

This is documented here:
https://docs.splunk.com/Documentation/MSApp/1.5.2/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind...

All the wineventlog inputs (Windows, AD, and DNS) will have renderXml=true (Xml Format) by default. Make it false for all WinEventLog Inputs as XML data is not supported.

But it is very easy to miss. After I modified the inputs.conf and redistributed it I regenerated the lookups (Tools and Setting > Build Lookups) and all is happy.

[davidjohnbecket]

thanks jeremyhagand61.

I have opened up a support ticket with Splunk on the lookups problem, they are currently working on it but because its a P3 there hasnt been much traction.

[jeremyhagand61]

The doco covering the Index config is here:
https://docs.splunk.com/Documentation/MSApp/1.5.2/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind...

You either have to add the
index = wineventlog

etc. into your Deployment App (and the app on your Splunk Enterprise install.

Not sure why the lookups are empty. I'm having the same issue.