topic Re: Splunk App for Web Analytics: Why am I getting "Eventtype 'brand-name' and 'internal-domain' not found or disabled" errors? in All Apps and Add-ons

Splunk App for Web Analytics: Why am I getting "Eventtype 'brand-name' and 'internal-domain' not found or disabled" errors?

rmsit — Sun, 12 Jul 2015 17:27:21 GMT

Hello,

After installing Splunk App for Web Analytics and building the lookups for IIS data, I receive errors that these event types do not exist or they are disabled. The error originates from the indexer and I have the app installed on the search head. How do I resolve these errors?

Re: Splunk App for Web Analytics: Why am I getting "Eventtype 'brand-name' and 'internal-domain' not found or disabled" errors?

jbjerke_splunk — Mon, 13 Jul 2015 15:57:59 GMT

Hi James

There was some undeclared eventtypes in the latest release (1.3) that caused a warning message on the search head. The warning message does not affect the functionality of the app as these eventtypes are not used. I will fix this in the next release of the app.

As a workaround you can create a file called eventtypes.conf and place it here:

SPLUNK_HOME/etc/apps/SplunkAppForWebAnalytics/local

The contents should be this:

[visitor-type-direct]
search = eventtype=web-traffic referer="-" OR (NOT eventtype=visitor-type-paid) 

[external-referer]
search = eventtype=web-traffic NOT (referer="-" OR referer="*q=*" OR referer="*p=*" OR eventtype=social-*)

[internal-referer]
disabled=1

[search-referer]
search = eventtype=web-traffic NOT eventtype=direct-referer (referer="*q=*" OR referer="*p=*")

[socialmedia-referer]
search = eventtype=social-* NOT eventtype=direct-referer

Re: Splunk App for Web Analytics: Why am I getting "Eventtype 'brand-name' and 'internal-domain' not found or disabled" errors?

rmsit — Thu, 08 Oct 2015 12:14:57 GMT

Hi Johan,

After upgrading to version 1.42 I am now receiving the errors below. Should I make the changes again that worked above?

Eventtype 'pageview' does not exist or is disabled.
Eventtype 'web-traffic' does not exist or is disabled.

Thanks,
James