Configure event type templates
Event type templates create event types at search time. If you have Splunk Enterprise, you define event type templates in eventtypes.conf. Edit
$SPLUNK_HOME/etc/system/local/, or your own custom app directory in
For more information on configuration files in general, see "About configuration files" in the Admin manual.
Event type template configuration
Event type templates use a field name surrounded by percent characters to create event types at search time where the
%$FIELD% value is substituted into the name of the event type.
So if the search query in the template returns an event where
%$FIELD%=bar, an event type titled
$NAME-bar is created for that event.
[cisco-%code%] search = cisco
If a search on "cisco" returns an event that has
code=432, Splunk Enterprise creates an event type titled "cisco-432".
Configure event types in eventtypes.conf
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 8.1.2103, 8.1.2008, 8.1.2011, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2009, 8.1.2012 (latest FedRAMP release), 8.1.2101