Archive

EventCode 4725 and 4726 not visible on search results

New Member

Hello,
We have Splunk Add-on for Microsoft Windows (SplunkTAwindows) deployed in our environment. There are 2 lookup tables which have information about the event codes in the add-on:

Name: xmlsecurityeventcodeactionlookup

Supported Fields: EventCode,action,Category,Subcategory,message,os

Lookup File: xmlsecurity
eventcodeaction.csv

App: Splunk
TAwindows
Status: Enabled
Name: xmlsecurity
eventcodeactionlookupmultiinput

Supported Fields: EventCode,action,Error
Code,Description

Lookup File:xmlsecurityeventcodeactionmultiinput.csv
App: Splunk
TA_windows
Status: Enabled

When I checked the input lookup tables xmlsecurityeventcodeaction.csv & xmlsecurityeventcodeaction_multiinput.csv the event codes 4725 and 4726 are present.
However I was not able to see the event code related logs.
Appreciate help.

Thanks,
Krish

Tags (1)
0 Karma

Motivator

Are you logging these Event Codes?
Search for "index=* EventCode=4725". Are there any results?

0 Karma