Event type discovery
This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
Contents
Event type discovery
Instead of using auto-discovery at index time, use Splunk's new event type discovery at search time. Use this feature to create custom event types directly in Splunk Web.
Configure event types
Configure event types with the typelearner command or by choosing Discover event types from Splunk's drop-down menu.
- Pipe any search to typelearner:
user=Hume | typelearner
- Or choose the Discover event types... option from the Splunk drop-down menu:
- Now pick Add Event Type underneath the event you want to classify as a new event type.
- This will launch a new window where you can label and tag your event type.