I just installed the Windows TA. Now, when I search, I get the following errors:
- Could not load lookup=LOOKUP-action_for_win_timesync_status
- Could not load lookup=LOOKUP-app4_for_windows_security
- Could not load lookup=LOOKUP-app_for_windows_system_ias
- Could not load lookup=LOOKUP-vendor_info_for_microsoft_dhcp
- Could not load lookup=LOOKUP-vendor_info_for_windows_security
- Could not load lookup=LOOKUP-vendor_info_for_windows_system
- Could not load lookup=LOOKUP-vendor_info_for_windowsupdatelog
These are all automated lookups in props.conf. The lookups don't exist. There are no saved searches in the TA that would create them.
How is it possible that the Windows TA (and Linux TA for that matter), which are two of the most downloaded apps in the Splunkbase, are so broken? I can't believe your company can find the time to build useless apps for the Apple Watch, but you can't nail the two most widely utilized apps for getting data into Splunk.
Shame on you.
