Documentation > Splunk > Admin Manual > eventdiscoverer.conf

Admin Manual

 


Welcome to Splunk administration
What to do first
Use Splunk Web
Meet Splunk apps
Configure Splunk
Indexing with Splunk
Add data and configure inputs
Set up forwarding and receiving
Configure event processing
Configure event timestamping
Configure indexed field extraction
Manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Deploy to other Splunk instances
Set up distributed search
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

eventdiscoverer.conf

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

eventdiscoverer.conf

The following are the spec and example files for eventdiscoverer.conf.

eventdiscoverer.conf.spec

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.1.5 

# This file contains possible attributes and values you can use to configure event discovery through
# the search command "typelearner."
#
# There is an eventdiscoverer.conf in $SPLUNK_HOME/etc/system/default/.  To set custom configurations, 
# place an eventdiscoverer.conf in $SPLUNK_HOME/etc/system/local/.  For examples, see 
# eventdiscoverer.conf.example. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles

ignored_keywords = <comma-separated list of terms> 
	* Terms in this list are never considered for defining an event type.  
	* If you find that eventtypes have terms you do not want considered (e.g., "mylaptopname"), add
	that term to this list.
	* Default = "sun, mon, tue,..." (see $SPLUNK_HOME/etc/system/default/eventdiscover.conf).

ignored_fields = <comma-separated list of fields>
	* Similar to ignored_keywords, except fields as defined in Splunk.
	* Defaults include time-related fields that would not be useful for defining an event type.

important_keywords = <comma-separated list of terms> 
	* When there are multiple possible phrases for generating an
          eventtype search, those phrases with important_keyword terms
          are favored.  For example, "fatal error" would be preferred
          over "last message repeated", as "fatal" is an important keyword.
	* Default = "abort, abstract, accept,..." (see $SPLUNK_HOME/etc/system/default/eventdiscover.conf).

eventdiscoverer.conf.example

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.1.5 
#
# This is an example eventdiscoverer.conf.  These settings are used to control the discovery of 
# common eventtypes used by the typelearner search command.
#
# To use one or more of these configurations, copy the configuration block into eventdiscoverer.conf 
# in $SPLUNK_HOME/etc/system/local/.  You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles


# Terms in this list are never considered for defining an eventtype.
ignored_keywords = foo, bar, application, kate, charlie

# Fields in this list are never considered for defining an eventtype.
ignored_fields = pid, others, directory
Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Eventdiscovererconf"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!