EventCode 4725 and 4726 not visible on search results

[krishscalar]

Hello,
We have Splunk Add-on for Microsoft Windows (Splunk_TA_windows) deployed in our environment. There are 2 lookup tables which have information about the event codes in the add-on:

Name: xmlsecurity_eventcode_action_lookup

Supported Fields: EventCode,action,Category,Subcategory,message,os

Lookup File: xmlsecurity_eventcode_action.csv

App: Splunk_TA_windows
Status: Enabled
Name: xmlsecurity_eventcode_action_lookup_multiinput

Supported Fields: EventCode,action,Error_Code,Description

Lookup File:xmlsecurity_eventcode_action_multiinput.csv
App: Splunk_TA_windows
Status: Enabled

When I checked the input lookup tables xmlsecurity_eventcode_action.csv & xmlsecurity_eventcode_action_multiinput.csv the event codes 4725 and 4726 are present.
However I was not able to see the event code related logs.
Appreciate help.

Thanks,
Krish

[whrg]

Are you logging these Event Codes?
Search for "index=* EventCode=4725". Are there any results?