Knowledge Management

Eventtype 'windows_account_created' does not exist or is disabled.


I've given read permissions for macro, app, eventtype, everything I can think of, to the role and/or everyone. This search keeps failing for all users in the role. It works fine for me as an admin. It even fails with the same message if I add the user to the power role along with the defined role.

event_sources eventtype=windows_account_created

It returns results for just the event_sources macro. But including eventtype windows_account_created shows no results along with:
alt text

I've exhausted any of my ideas. Thoughts?

Tags (2)
0 Karma


If you go to Settings->Event types and set the permissions for windows_account_created to Global, it should fix the problem.

If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!