Admin Manual

eventtypes.conf

The following are the spec and example files for eventtypes.conf.

eventtypes.conf.spec

# Copyright (C) 2005-2011 Splunk Inc. All Rights Reserved.  Version 4.3.1 
#
# This file contains all possible attributes and value pairs for an eventtypes.conf file.  
# Use this file to configure event types and their properties. You can also pipe any search
# to the "typelearner" command to create event types.  Event types created this way will be written
# to $SPLUNK_HOME/etc/systems/local/eventtypes.conf.
#
# There is an eventtypes.conf in $SPLUNK_HOME/etc/system/default/.  To set custom configurations, 
# place an eventtypes.conf in $SPLUNK_HOME/etc/system/local/. For examples, see 
# eventtypes.conf.example. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles


[<$EVENTTYPE>]
* Header for the event type
* $EVENTTYPE is the name of your event type.
* You can have any number of event types, each represented by a stanza and any number of the following 
attribute/value pairs.  
* NOTE: If the name of the event type includes field names surrounded by the percent 
character (for example "%$FIELD%") then the value of $FIELD is substituted into the event type
name for that event.  For example, an event type with the header [cisco-%code%] that has
"code=432" becomes labeled "cisco-432".

disabled = [1|0]
* Toggle event type on or off.
* Set to 0 to disable.
	
search = <string>
* Search terms for this event type. 
* For example: error OR warn.

priority = <integer, 1 through 10>
* Value used to determine the order in which the matching eventtypes of an event are displayed.  
* 1 is the highest and 10 is the lowest priority. 

description = <string>
* Optional human-readable description of this saved search.

tags = <string>
* DEPRECATED - see tags.conf.spec

eventtypes.conf.example

# Copyright (C) 2005-2011 Splunk Inc. All Rights Reserved.  Version 4.3.1 
#
# This file contains an example eventtypes.conf.  Use this file to configure custom eventtypes.
#
# To use one or more of these configurations, copy the configuration block into eventtypes.conf 
# in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles
#

# The following example makes an eventtype called "error" based on the search "error OR fatal."

[error]
search = error OR fatal



# The following example makes an eventtype template because it includes a field name
# surrounded by the percent character (in this case "%code%"). 
# The value of "%code%" is substituted into the event type name for that event. 
# For example, if the following example event type is instantiated on an event that has a
# "code=432," it becomes "cisco-432".

[cisco-%code%]
search = cisco