Documentation > Splunk > Knowledge Manager Manual > Configure event type templates

Knowledge Manager Manual

 


Welcome to knowledge management
Organize and administrate knowledge objects
Data interpretation: Fields and field extractions
Data classification: Event types and transactions
Data enrichment: Lookups and workflow actions
Data normalization: Tags and aliases
Manage your search knowledge
Set up and use summary indexes

Configure event type templates

Contents

Configure event type templates

Event type templates create event types at search time. Define event type templates in eventtypes.conf. Edit eventtypes.conf in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/.

For more information on configuration files in general, see "About configuration files" in the Admin manual.


Event type template configuration

Event type templates use a field name surrounded by percent characters to create event types at search time where the %$FIELD% value is substituted into the name of the event type. 

[$NAME-%$FIELD%]
$SEARCH_QUERY

So if the search query in the template returns an event where %$FIELD%=bar, Splunk creates an event type titled $NAME-bar for that event.


Example 

[cisco-%code%]
search = cisco

If a search on "cisco" returns an event that has code=432, Splunk creates an event type titled "cisco-432".

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.3/Knowledge/Configureeventtypetemplates"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!