I just installed the Windows TA. Now, when I search, I get the following errors:
Could not load lookup=LOOKUP-action_for_win_timesync_status
Could not load lookup=LOOKUP-app4_for_windows_security
Could not load lookup=LOOKUP-app_for_windows_system_ias
Could not load lookup=LOOKUP-vendor_info_for_microsoft_dhcp
Could not load lookup=LOOKUP-vendor_info_for_windows_security
Could not load lookup=LOOKUP-vendor_info_for_windows_system
Could not load lookup=LOOKUP-vendor_info_for_windowsupdatelog
These are all automated lookups in props.conf. The lookups don't exist. There are no saved searches in the TA that would create them.
How is it possible that the Windows TA (and Linux TA for that matter), which are two of the most downloaded apps in the Splunkbase, are so broken? I can't believe your company can find the time to build useless apps for the Apple Watch, but you can't nail the two most widely utilized apps for getting data into Splunk.