topic Re: eventtype error in Knowledge Management

eventtype error

michaelrosello — Sun, 26 Aug 2018 14:24:41 GMT

Why do I get this error when using eventtype?

This is the eventtype configuration and I also tried running that search and it works fine.

Re: eventtype error

kamlesh_vaghela — Sun, 26 Aug 2018 14:57:31 GMT

@michaelrosello

Can you please share eventtype configuration ?

Re: eventtype error

michaelrosello — Sun, 26 Aug 2018 15:01:01 GMT

@kamlesh_vaghela Hi, I've updated my question with the configuration.

Re: eventtype error

kamlesh_vaghela — Sun, 26 Aug 2018 15:17:24 GMT

@michaelrosello I've tried with your configuration but unable to reproduce this error. Your configurations looks proper. Can you please try to create new EventType with the same configuration? Just minor correction keep blank between IN and (.

Re: eventtype error

DalJeanis — Mon, 27 Aug 2018 02:06:32 GMT

First, check the index= and get rid of the space in it.

Second, it is possible that an unprintable/invisible character was put into the definition by cut-and-paste. This happens extremely often and is the hardest thing to identify. The solution is to retype the list manually, and see if that helps.

Third, if that didn't fix it, try each of the below with an IN clause that has only three items until you know the proper syntax is working.

 IN (20,30,50) 
 IN (20, 30, 50) 
 IN (20 30 50) 
 IN ("20","30","50")
 IN ("20", "30", "50")
 IN ("20" "30" "50")

All of the above should work, so we're trying to determine if there are additional undocumented limits when used in this manner.

Finally, if none of the above results in a working definition, check btool and see if you have a conflicting eventtype definition.

Re: eventtype error

DalJeanis — Mon, 27 Aug 2018 02:39:41 GMT

what version are you on

Re: eventtype error

michaelrosello — Tue, 28 Aug 2018 04:54:22 GMT

I'm on 6.6.2

Re: eventtype error

michaelrosello — Tue, 29 Sep 2020 21:02:35 GMT

Hmm I tried typing it manual IN(20, 30).

weirdly enough when I search index=myindex eventtype=AIOPS_COE_REPORT I still get the same error.

But when I search for just the index. i can see an eventtpe in my interesting field with the correct eventtype value which is the AIOPS_COE_REPORT

I also tried clicking it to add it to search, then I get again the same error.