Eventtype 'msad-rep-errors' does not exist or is disabled

[rukshar]

I have a dashboard which gives the below error at user end but when i open the dashboard i dont see any error at my end and it perfectly runs fine with the proper result

• Error in 'lookup' command: Could not construct lookup 'EventCodes, EventCode, LogName, OUTPUTNEW, desc'. See search.log for more details.
• Eventtype 'msad-rep-errors' does not exist or is disabled.
  
  

Please help me how to fix this issue.

[marnall]

Could you post the sanitized search from that panel? It likely has a broken reference to a lookup and/or an eventtype.

[rukshar]

eventtype=msad-rep-errors (host="*")|lookup EventCodes EventCode,LogName OUTPUTNEW desc|eval desc=if(isnull(desc),"Unknown EventCode",desc)
| stats count by host,Type,EventCode,LogName,desc
| lookup DCs_tier0.csv host OUTPUTNEW domain offset_value
| search offset_value=1
| search (host="*") (domain="*")
| table host domain Type EventCode LogName desc

[marnall]

I suspect the issue lies with the line:

| lookup EventCodes EventCode,LogName OUTPUTNEW desc

I assume this is intended to use a lookup definition called EventCodes. Could you try using inputlookup on EventCodes in a separate search and see which, if any, columns appear?

| inputlookup EventCodes

If there are no results, then either EventCodes does not exist as a lookup definition or you have no permissions to view it.

If there are columns but there are none called "EventCode","LogName" or "dest", then you'll need to adjust those column names in the lookup command.