eventtypes.conf

eventtypes.conf

eventtypes.conf stores definition and tags for event types, whether they were discovered by Splunk automatically or defined by users in SplunkWeb.

IMPORTANT: If you want to disable any event type from eventtypes.conf, you can either:

• delete the eventtype from $SPLUNK_HOME/etc/bundles/default/eventtypes.conf or you can
• add the tag priority = 0 to any event type entry.
  • you can set priority = 0 in $SPLUNK_HOME/etc/bundles/local/eventtypes.conf for any entry in ../default/eventtypes.conf to override the default entry.

eventtypes.conf.spec

Copyright (C) 2005-2007 Splunk Inc.  All Rights Reserved.  Version 3.0 
# This file contains all the possible values for eventtype entries in a
# eventtypes.conf file.
# A configuration looks like:
# [<eventtype name>]
# attribute1 = val1
# ...
[<eventtype name>]
        * Name of the eventtype (header)
query = <string>
        * Actual query terms of this eventtype (i.e. error OR warn)
userid = <integer>
        * UserId that is bound to this splunk, use "1" for admin
        Possible values: Any splunk user id.
isglobal = <integer>
        * If isglobal is set to 1, everyone can see/use this search
        ( Possible values: 1/0 ).
tags = <string>
        * Space separated words that are used to tag an eventtype

eventtypes.conf.example

# Copyright (C) 2005-2007 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# EXAMPLE of eventtype
#
# This simple example shows how to create an eventtype.
# Pre-defined eventtypes are found in $SPLUNK_HOME/etc/bundles/local/eventtypes.conf.
[error]
# query the search will be executing
query = error OR fatal
tags = error problem alert important

• Was this topic useful?
• Post a comment