Documentation: 3.2
|  Print Version Contents
This page last updated: 05/20/08 11:05am

Configure eventtypes.conf

Add your own event types by configuring eventtypes.conf. There are a few default event types defined in $SPLUNK_HOME/etc/bundles/default/eventtypes.conf. Any event types you create through Splunk Web will automatically be added to $SPLUNK_HOME/etc/bundles/local/eventtypes.conf.

Configuration

Make changes to event types in eventtypes.conf. Use $SPLUNK_HOME/etc/bundles/README/eventtypes.conf.example as an example, or create your own eventtypes.conf. Make any configuration changes to a copy of eventtypes.conf in $SPLUNK_HOME/etc/bundles/local/, or your own custom bundle directory. For more information on configuration files in general, see how configuration files work.

[$EVENTTYPE]

  • Header for the event type
  • $EVENTTYPE is the name of your event type.
    • You can have any number of event types, each represented by a stanza and any number of the following attribute/value pairs.
  • Note: If the name of the event type includes field names surrounded by the percent character (e.g. "%$FIELD%") then the value of $FIELD is substituted into the event type name for that event. For example, an event type with the header [cisco-%code%] that has "code=432" becomes labeled "cisco-432".

disabled = <1 or 0>

  • Toggle event type on or off.
  • Set to 1 to disable.

name = <string>

  • Actual displayed name of the event type.

query = <string>

  • Search query terms for this event type.
  • For example: error OR warn.

tags = <string>

  • Space separated words that are used to tag an event type.

isglobal = <1 or 0>

  • Toggle whether event type is shared.
  • If isglobal is set to 1, everyone can see/use this event type.
  • Defaults to 1.

Example

[web]
query = html OR http OR https OR css OR htm OR html OR shtml OR xls OR cgi

[fatal]
query = FATAL

Disable event types

Disable specific event types by adding the following tag to $SPLUNK_HOME/etc/bundles/local/eventtypes.conf:

[$EVENTTYPE]
disabled = 1

$EVENTTYPE is the name of the event type you wish to disable.

So if you want to disable the [web] event type, add the following entry to ../local/eventtypes.conf:

[web]
disabled = 1
Previous: Save event types via Splunk Web    |    Next: Tag event types

Comments

No comments have been submitted.

Log in to comment.