typelearner command is deprecated as of Splunk Enterprise version 5.0. This means that although the command continues to function, it might be removed in a future version.
findtypes command instead.
Generates suggested event types by taking previous search results and producing a list of potential searches that can be used as event types. By default, the
typelearner command initially groups events by the value of the grouping-field. The search then unifies and merges these groups based on the keywords they contain.
typelearner [<grouping-field>] [<grouping-maxlen>]
- Syntax: <field>
- Description: The field with values for the
typelearnercomman to use when initially grouping events.
punct, the punctuation seen in
- Syntax: maxlen=<int>
- Description: Determines how many characters in the grouping-field value to look at. If set to negative, the entire value of the grouping-field value is used to group events.
- Default: 15
Have the search automatically discover and apply event types to search results.
... | typelearner
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the typelearner command.
This documentation applies to the following versions of Splunk Cloud™: 7.0.11, 7.0.13, 7.1.3, 7.1.6, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 8.0.2001, 8.0.2003, 8.0.2004