findtypes
Description
Generates suggested event types by taking the results of a search and producing a list of potential event types. At most, 5000 events are analyzed for discovering event types.
Syntax
findtypes max=<int> [notcovered] [useraw]
Required arguments
- max
- Datatype: <int>
- Description: The maximum number of events to return.
- Default: 10
Optional arguments
- notcovered
- Description: If this keyword is used, the
findtypes
command returns only event types that are not already covered.
- useraw
- Description: If this keyword is used, the
findtypes
command uses phrases in the _raw text of events to generate event types.
Examples
Example 1:
Discover 10 common event types.
... | findtypes
Example 2:
Discover 50 common event types and add support for looking at text phrases.
... | findtypes max=50 useraw
See also
fillnull | folderize |
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release), 9.2.2406
Feedback submitted, thanks!