eventdiscoverer.conf

eventdiscoverer.conf

Eventdiscover.conf controls whether and how Splunk attempts to automatically learn new event types.

To edit this configuration for your local Splunk server, make your edits in $SPLUNK_HOME/etc/bundles/local/eventdiscoverer.conf.

You can create this file by copying examples from $SPLUNK_HOME/etc/bundles/README/eventdiscoverer.conf.example.

Never edit files in our default bundle in $SPLUNK_HOME/etc/bundles/default or your changes may be overwritten in an upgrade.

eventdiscoverer.conf.spec

use_any_keyword = <boolean> (default = "true")
        * If true, eventtypes discovered can be generated from any
          keyword the algorithm finds useful for clustering events;
          otherwise, only keywords in the known_keywords list are used
          for generating eventtype.
ignored_keywords = <comma-separate list of term> (default = "sun, mon, tue,...")
        * Terms in this list are never considered for defining an
          eventtype.  If you find that eventtypes have terms you do
          not want considered (e.g., "mylaptopname"), add that term to
          this list.
known_keywords = <comma-separate list of term> (default = "300, 301, 302,...")
        * If use_any_keyword is false, only terms in this list are
          considered for defining an eventtype.  If you find that
          eventtypes aren't being discovered with terms that you
          think should be discovered and you have use_any_keyword = false,
          consider adding terms to this list or changing
          use_any_keyword to be true.
max_format_len = <integer> (1-300. default = "5" characters)
        * Determines the maximum length of the punct:: attribute added
          to eventtypes.  The larger the value, the more attention is
          paid to the structure of events vs the keywords in them.
learned_eventtype_priority = <integer> (1-10. default = "1")
        * The priority value for learned eventtypes.  A lower value
          means lower priority.
process_every_n_events = <integer> (between 1-inf.  default = "5" events)
        * Consider every N events to discover eventtypes.  The larger
          the value, the faster indexing will be, but the lower the
          rate at which eventtypes will be discovered. 

• Was this topic useful?
• Post a comment