Wineventtype_security does not exist or disabled

[romulusc]

Hello all,

I am currently getting this yellow triangle warning on the corner of the "Job" section when running a query. The error states "Wineventtype_security does not exist or is disabled". This happens in both the native "Search and Reporting" App and the "Splunk App or Windows Infrastructure" app. When I run one of the preset jobs in the Splunk App for Windows Infrastructure I get the same "warning" symbol and then the search results end up coming back with NO results for certain searches like "Failed Logins" for example.

I have a feeling it's preventing me from performing searches having to do with AD information pertaining to Windows Security logs such as User changes (adds/changes/etc)

I have some pictures to help describing what I am saying:

If anyone could shed any light on this it would be appreciated. I've already submitted a ticket to Splunk Support but they've hardly addressed this (too busy with vacations and whatnot).

[tiagofbmm]

That is an eventtype that exists by default in the latest Splunk TA for Windows. If it's not accessible I'd start checking the metadata for that knowledge object in the Windows TA under local, also the files permissions and ownership in conf files of the app

[romulusc]

Thank you for your reply. So after you said that this was a Windows TA I thought of the Splunk App for Windows. Low and behold the app is disabled. I believe I disabled this app because it is incompatible with the Splunk App for Windows Infrastructure (even though Splunk says that the Splunk App for Windows Infrastructure v.1.5.1 is compatible with Splunk App for Windows v 5.0 and later). I went on a whim and enabled the Splunk App for Windows again. However after doing this I got the error: Could not load lookup=LOOKUP-app4_for_windows_security

After looking at this for a bit most of the past answers involved disabling the Splunk App for Windows which leads me back to square 1. I tried upgrading the Splunk App for Windows Infrastructure to v. 1.5.2 but getting errors doing so.

[tiagofbmm]

I don't get where is that lookup coming from. It is not in the most up to date app for win infra or in the Windows TA.

The eventtype you had a problem before is in the TA for windows https://splunkbase.splunk.com/app/742/

Make sure you install that in your search head so you can get search enrichments you want.

Besides that, I'd check on your splunk env where that lookup is referred cause I really can't find it