The Splunk_TA_ossec files are missing from the Splunk Add-on for OSSEC:
Splunk documentation claims that they should be there for OSSEC dashboards:
Anyone know where to find them?
Thanks for your quick answer, and correct clarification.
My confusion was a result of there being TWO ossec config files:
1) ossec-hids-2.8.3.tar.gz -> installs ossec itself
2) splunk_add-on-for-ossec_401 -> installs Splunk_TA_ossec, for ossec/Splunk integration.
I had just missed the second one.
After you install the add-on, the lookup files can be found in the installation directory here;
Hope it helps. Thanks!