We have Splunk Add-on for Microsoft Windows (SplunkTAwindows) deployed in our environment. There are 2 lookup tables which have information about the event codes in the add-on:
Supported Fields: EventCode,action,Category,Subcategory,message,os
Lookup File: xmlsecurityeventcodeaction.csv
Supported Fields: EventCode,action,ErrorCode,Description
When I checked the input lookup tables xmlsecurityeventcodeaction.csv & xmlsecurityeventcodeaction_multiinput.csv the event codes 4725 and 4726 are present.
However I was not able to see the event code related logs.
Are you logging these Event Codes?
Search for "index=* EventCode=4725". Are there any results?