topic Re: Web Intelligence: local/eventtypes.conf will not override default/eventtypes.conf in Knowledge Management

Web Intelligence: local/eventtypes.conf will not override default/eventtypes.conf

oscarspaz — Tue, 10 Jan 2012 22:09:12 GMT

I was trying the use ./local/eventtypes.conf to override the values in ./default/eventtypes.conf.
Using btool, it shows that local eventtype was picked. However, in Splunk web Manager->Event Type, it shows the default values instead of local values. Therefore, Web Intelligence App failed to assigned the correct eventtypes to incoming logs.

Does anyone has the same problem? How do you fix it?

Re: Web Intelligence: local/eventtypes.conf will not override default/eventtypes.conf

dwaddle — Tue, 10 Jan 2012 22:37:35 GMT

Potentially dumb question, but local/eventtypes.conf versus local/eventtype.conf? Is this merely a typo?

Re: Web Intelligence: local/eventtypes.conf will not override default/eventtypes.conf

oscarspaz — Tue, 10 Jan 2012 23:51:03 GMT

Thank for pointing that out. It was a typo. I updated the post.

Re: Web Intelligence: local/eventtypes.conf will not override default/eventtypes.conf

araitz — Wed, 11 Jan 2012 05:38:14 GMT

A more primary question: why aren't you using the apps' own Setup workflow?

Re: Web Intelligence: local/eventtypes.conf will not override default/eventtypes.conf

oscarspaz — Wed, 11 Jan 2012 06:02:25 GMT

I followed the instructions and use the Setup workflow and get no results. I managed to get it working by editing the default/eventtypes.conf.

I documented my discoveries in this post

http://splunk-base.splunk.com/answers/34974/no-results-found-using-web-intelligence-app

I am beginning to wonder if it is a problem for Windows only.