- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Event type disabled
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Event type disabled
On the various dashboards created after the upgrade of the last Splunk Enterprice version (6.4.2) a yellow triangle is now present.
Selecting it a pop-up appear saying "Evernttype 'wineventlog-dns" disabled or does not exist.
How can disabled it and find what introduced it
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe that the issue is stemming from the Windows Infrastructure App upgrade when the DNS TA is not also upgraded. It looks like the Windows Infra App is looking to create msad-dns-events eventtype using a search that involves OR (eventtype=wineventlog-dns (Type=Warning OR Type=Error))
Installing Splunk Add-on for Microsoft Windows DNS (https://splunkbase.splunk.com/app/3208/) contains the missing lookup and removes the error. This may need to be installed on a Forwarder, Indexer, and/or Search Head depending on your deployment.
Btool export from Windows Infra App's default/eventtypes.conf:
[msad-dns-events]
search = ((eventtype=wineventlog_application OR eventtype=wineventlog_system OR eventtype=wineventlog_security) (Type=Warning OR Type=Error) DNS) OR (eventtype=wineventlog-dns (Type=Warning OR Type=Error))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is very helpful ** i installed the add on Windows Infrastructure App upgrade when the DNS
and all the data warning gone . good one !!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On your search head open Settings > Event Types
In here, search for "wineventlog-dns" and check it's status. If it's disabled, you could try re-enabling it.
When upgrading splunk odd things somethings get turned off / on - this may just be one of those things?
Before re-enabling the event type, run through the logic of the search string to make sure it will do what you expect, as any post-install pre-upgrade changes made may also have been reset.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have this issue as well, however I have no event type called wineventlog-dns, for me this happened after upgrading to 6.4.2, however I believe it started when I upgraded the windows infrastructure app
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same thing happened to me.
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
