
findtypes
Description
Generates suggested event types by taking the results of a search and producing a list of potential event types. At most, 5000 events are analyzed for discovering event types.
Syntax
findtypes max=<int> [notcovered] [useraw]
Required arguments
- max
- Datatype: <int>
- Description: The maximum number of events to return.
- Default: 10
Optional arguments
- notcovered
- Description: If this keyword is used, the
findtypes
command returns only event types that are not already covered.
- useraw
- Description: If this keyword is used, the
findtypes
command uses phrases in the _raw text of events to generate event types.
Examples
Example 1:
Discover 10 common event types.
... | findtypes
Example 2:
Discover 50 common event types and add support for looking at text phrases.
... | findtypes max=50 useraw
See also
PREVIOUS fillnull |
NEXT folderize |
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012, 8.1.2101
Feedback submitted, thanks!