Configure event types directly in eventtypes.conf
You can add new event types and update existing event types by configuring eventtypes.conf. There are a few default event types defined in
$SPLUNK_HOME/etc/system/default/eventtypes.conf. Any event types you create through Splunk Web are automatically added to
Make changes to event types in
$SPLUNK_HOME/etc/system/README/eventtypes.conf.example as an example, or create your own
$SPLUNK_HOME/etc/system/local/, or your own custom application directory in
$SPLUNK_HOME/etc/apps/. For more information on configuration files in general, see "About configuration files" in the Admin manual.
- Header for the event type
$EVENTTYPEis the name of your event type.
- You can have any number of event types, each represented by a stanza and any number of the following attribute/value pairs.
Note: If the name of the event type includes field names surrounded by the percent character (for example,
%$FIELD%) then the value of
$FIELD is substituted at search time into the event type name for that event. For example, an event type with the header
[cisco-%code%] that has
code=432 becomes labeled
disabled = <1 or 0>
- Toggle event type on or off.
- Set to 1 to disable.
search = <string>
- Search terms for this event type.
- For example: error OR warn.
tags = <string>
- Space separated words that are used to tag an event type.
description = <string>
- Optional human-readable description of the event type.
priority = <integer>
- Splunk uses this value to determine the order in which it displays matching event types for an event. 1 is the highest, and 10 is the lowest.
Note: You can tag
eventtype field values the same way you tag any other field/value combination. See the
tags.conf spec file for more information.
Here are two event types; one is called
web, and the other is called
[web] search = html OR http OR https OR css OR htm OR html OR shtml OR xls OR cgi [fatal] search = FATAL
Disable event types
Disable an event type by adding
disabled = 1 to the event type stanza
[$EVENTTYPE] disabled = 1
$EVENTTYPE is the name of the event type you wish to disable.
So if you want to disable the
web event type, add the following entry to its stanza:
[web] disabled = 1
Define and maintain event types in Splunk Web
Configure event type templates
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7