eventtypes.conf

eventtypes.conf

eventtypes.conf stores definition and tags for event types, whether they were discovered by Splunk automatically or defined by users in Splunk Web.

Note: To disable any event type from eventtypes.conf:

• Delete the eventtype from $SPLUNK_HOME/etc/system/default/eventtypes.conf
• Add the tag disabled = 0 to any event type entry.
  • Set disabled = 0 in $SPLUNK_HOME/etc/system/local/eventtypes.conf for any entry in ../default/eventtypes.conf to override the default entry.

eventtypes.conf.spec

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains all possible attributes and value pairs for an eventtypes.conf file.  
# Use this file to configure event types and their properties. You can also pipe any search
# to the "typelearner" command to create event types.  Event types created this way will be written
# to $SPLUNK_HOME/etc/systems/local/eventtypes.conf.
#
# There is an eventtypes.conf in $SPLUNK_HOME/etc/system/default/.  To set custom configurations, 
# place an eventtypes.conf in $SPLUNK_HOME/etc/system/local/. For examples, see 
# eventtypes.conf.example. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
[$EVENTTYPE]
        * Header for the event type
        * $EVENTTYPE is the name of your event type.
        * You can have any number of event types, each represented by a stanza and any number 
        of the following attribute/value pairs.  
              * NOTE: If the name of the event type includes field names surrounded by the percent 
              character (e.g. "%$FIELD%") then the value of $FIELD is substituted into the event type
          name for that event.  For example, an event type with the header [cisco-%code%] that has
          "code=432" becomes labeled "cisco-432".
disabled = <1 or 0>
        * Toggle event type on or off.
        * Set to 1 to disable.
        
search = <string>
        * Search terms for this event type. 
        * For example: error OR warn.
tags = <string>
        * Space separated words that are used to tag an event type.
isglobal = <1 or 0>
        * Toggle whether event type is shared.
        * If isglobal is set to 1, everyone can see/use this event type.
        * Defaults to 1.

eventtypes.conf.example

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains an example eventtypes.conf.  Use this file to configure custom eventtypes.
#
# To use one or more of these configurations, copy the configuration block into eventtypes.conf 
# in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
#
# The following example makes an eventtype called "error" based on the search "error OR fatal."
[error]
search = error OR fatal
tags = error problem alert important
# The following example makes an eventtype template because it includes a field name
# surrounded by the percent character (in this case "%code%"). 
# The value of "%code%" is substituted into the event type name for that event. 
# For example, if the following example event type is instantiated on an event that has a
# "code=432," it becomes "cisco-432".
[cisco-%code%]
search = cisco

• Was this topic useful?
• Post a comment