Knowledge Management

Wineventtype_security does not exist or disabled

romulusc
New Member

Hello all,

I am currently getting this yellow triangle warning on the corner of the "Job" section when running a query. The error states "Wineventtype_security does not exist or is disabled". This happens in both the native "Search and Reporting" App and the "Splunk App or Windows Infrastructure" app. When I run one of the preset jobs in the Splunk App for Windows Infrastructure I get the same "warning" symbol and then the search results end up coming back with NO results for certain searches like "Failed Logins" for example.

I have a feeling it's preventing me from performing searches having to do with AD information pertaining to Windows Security logs such as User changes (adds/changes/etc)

I have some pictures to help describing what I am saying:
alt text

alt text

If anyone could shed any light on this it would be appreciated. I've already submitted a ticket to Splunk Support but they've hardly addressed this (too busy with vacations and whatnot).

0 Karma

tiagofbmm
Influencer

That is an eventtype that exists by default in the latest Splunk TA for Windows. If it's not accessible I'd start checking the metadata for that knowledge object in the Windows TA under local, also the files permissions and ownership in conf files of the app

romulusc
New Member

Thank you for your reply. So after you said that this was a Windows TA I thought of the Splunk App for Windows. Low and behold the app is disabled. I believe I disabled this app because it is incompatible with the Splunk App for Windows Infrastructure (even though Splunk says that the Splunk App for Windows Infrastructure v.1.5.1 is compatible with Splunk App for Windows v 5.0 and later). I went on a whim and enabled the Splunk App for Windows again. However after doing this I got the error: Could not load lookup=LOOKUP-app4_for_windows_security

After looking at this for a bit most of the past answers involved disabling the Splunk App for Windows which leads me back to square 1. I tried upgrading the Splunk App for Windows Infrastructure to v. 1.5.2 but getting errors doing so.

0 Karma

tiagofbmm
Influencer

I don't get where is that lookup coming from. It is not in the most up to date app for win infra or in the Windows TA.

The eventtype you had a problem before is in the TA for windows https://splunkbase.splunk.com/app/742/

Make sure you install that in your search head so you can get search enrichments you want.

Besides that, I'd check on your splunk env where that lookup is referred cause I really can't find it

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...