eventdiscoverer.conf

eventdiscoverer.conf

eventdiscover.conf controls whether and how Splunk attempts to automatically learn new event types.

eventdiscoverer.conf.spec

# This file contains possible attributes and values you can use to configure event discovery through
# the search command "typelearner."
#
# There is an eventdiscoverer.conf in $SPLUNK_HOME/etc/bundles/default/.  To set custom configurations, 
# place an eventdiscoverer.conf in your own custom bundle directory.  For examples, see 
# eventdiscoverer.conf.example.
#
# For help creating a bundle directory, or to learn more about bundles (including bundle precedence)
# please see the documentation located at http://www.splunk.com/doc/latest/admin/bundleconfig.
ignored_keywords = <comma-separated list of terms> 
	* Terms in this list are never considered for defining an event type.  
	* If you find that eventtypes have terms you do not want considered (e.g., "mylaptopname"), add
	that term to this list.
	* Default = "sun, mon, tue,..." (see $SPLUNK_HOME/etc/bundles/default/eventdiscover.conf).
ignored_fields = <comma-separated list of fields>
	* Similar to ignored_keywords, except fields as defined in Splunk.
	* Defaults include time-related fields that would not be useful for defining an event type.

eventdiscoverer.conf.example

# This is an example eventdiscoverer.conf.  These settings are used to control the discovery of 
# common eventtypes used by the typelearner search command.
#
# There is a default eventdiscoverer.conf. Use this example file to create your own custom 
# eventdiscoverer.conf.
#
# To set custom configurations, place an eventdiscoverer.conf in your own custom bundle directory
#
# Terms in this list are never considered for defining an eventtype.
ignored_keywords = foo, bar, application, kate, charlie
# Fields in this list are never considered for defining an eventtype.
ignored_fields = pid, others, directory

• Was this topic useful?
• Post a comment