Documentation > Splunk > Admin Manual > eventdiscoverer.conf

Admin Manual

 


How Splunk Works
Getting Started
Data Inputs
Data Distribution
Indexing
Timestamps
Fields
Hosts
Source Types
Event Types
Transaction Types
Search
Distributed Search
Security
Data Management
Deployment Server
Performance Tuning
Configuration Files
Applications
Reference
Troubleshooting

eventdiscoverer.conf

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

eventdiscoverer.conf

eventdiscover.conf controls whether and how Splunk attempts to automatically learn new event types.

eventdiscoverer.conf.spec 

# This file contains possible attributes and values you can use to configure event discovery through
# the search command "typelearner."
#
# There is an eventdiscoverer.conf in $SPLUNK_HOME/etc/bundles/default/.  To set custom configurations, 
# place an eventdiscoverer.conf in your own custom bundle directory.  For examples, see 
# eventdiscoverer.conf.example.
#
# For help creating a bundle directory, or to learn more about bundles (including bundle precedence)
# please see the documentation located at http://www.splunk.com/doc/latest/admin/bundleconfig.
ignored_keywords = <comma-separated list of terms> 
	* Terms in this list are never considered for defining an event type.  
	* If you find that eventtypes have terms you do not want considered (e.g., "mylaptopname"), add
	that term to this list.
	* Default = "sun, mon, tue,..." (see $SPLUNK_HOME/etc/bundles/default/eventdiscover.conf).
ignored_fields = <comma-separated list of fields>
	* Similar to ignored_keywords, except fields as defined in Splunk.
	* Defaults include time-related fields that would not be useful for defining an event type.

eventdiscoverer.conf.example 

# This is an example eventdiscoverer.conf.  These settings are used to control the discovery of 
# common eventtypes used by the typelearner search command.
#
# There is a default eventdiscoverer.conf. Use this example file to create your own custom 
# eventdiscoverer.conf.
#
# To set custom configurations, place an eventdiscoverer.conf in your own custom bundle directory
#
# Terms in this list are never considered for defining an eventtype.
ignored_keywords = foo, bar, application, kate, charlie
# Fields in this list are never considered for defining an eventtype.
ignored_fields = pid, others, directory
Retrieved from "http://docs.splunk.com/Documentation/Splunk/3.2.6/Admin/Eventdiscovererconf"

This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!