eventtypes.conf

eventtypes.conf

eventtypes.conf stores definition and tags for event types, whether they were discovered by Splunk automatically or defined by users in Splunk Web.

Note: To disable any event type from eventtypes.conf:

• Delete the eventtype from $SPLUNK_HOME/etc/bundles/default/eventtypes.conf
• Add the tag disabled = 0 to any event type entry.
  • Set disabled = 0 in $SPLUNK_HOME/etc/bundles/local/eventtypes.conf for any entry in ../default/eventtypes.conf to override the default entry.

eventtypes.conf.spec

# This file contains all possible attributes and value pairs for an eventtypes.conf
# file.  Use this file to configure event types and their properties. You can also pipe any search
# to the "typelearner" command to create event types.  Event types created this way will be written
# to $SPLUNK_HOME/etc/bundles/local/eventtypes.conf.
#
# There is an eventtypes.conf in $SPLUNK_HOME/etc/bundles/default/.  To set custom configurations, 
# place an eventtypes.conf in your own custom bundle directory.
#
# For help creating a bundle directory, or to learn more about bundles (including bundle precedence)
# please see the documentation located at http://www.splunk.com/doc/latest/admin/bundleconfig.
[$EVENTTYPE]
	* Header for the event type
	* $EVENTTYPE is the name of your event type.
	* You can have any number of event types, each represented by a stanza and any number 
	of the following attribute/value pairs.  
	      * NOTE: If the name of the event type includes field names surrounded by the percent 
	      character (e.g. "%$FIELD%") then the value of $FIELD is substituted into the event type
          name for that event.  For example, an event type with the header [cisco-%code%] that has
          "code=432" becomes labeled "cisco-432".
disabled = <1 or 0>
	* Toggle event type on or off.
	* Set to 0 to disable.
name = <string>
	* Actual displayed name of the event type.
	
query = <string>
	* Search query terms for this event type. 
	* For example: error OR warn.
tags = <string>
	* Space separated words that are used to tag an event type.
isglobal = <1 or 0>
	* Toggle whether event type is shared.
	* If isglobal is set to 1, everyone can see/use this event type.
	* Defaults to 1.

eventtypes.conf.example

# This file contains an example eventtypes.conf.  Use this file to configure custom eventtypes.
#
# To use one or more of these configurations, copy the configuration block into
# eventtypes.conf in your own custom bundle.
#
# For help creating a bundle directory, or to learn more about bundles (including bundle precedence)
# please see the documentation located at http://www.splunk.com/doc/latest/admin/bundleconfig.
#
# The following example makes an eventtype called "error" based on the search "error OR fatal."
[error]
query = error OR fatal
tags = error problem alert important
# The following example makes an eventtype template because it includes a field name
# surrounded by the percent character (in this case "%code%"). 
# The value of "%code%" is substituted into the event type name for that event. 
# For example, if the following example event type is instantiated on an event that has a
# "code=432," it becomes "cisco-432".
[cisco-%code%]
query = cisco

• Was this topic useful?
• Post a comment