https://community.splunk.com/t5/Knowledge-Management/eventtypes-combination/m-p/74481#M728 <P>event types are really just mini saved searches, so you could simply take your 4 event types and place them into a search like</P> <P>eventtype=purchase-w OR eventtype=purchase-x OR eventtype=purchase-y OR eventtype=purchase-Z</P> <P>Then save this is as an event type called "purchase" so the next time you search you could simply type <CODE>eventtype=purchase</CODE></P> <P>or you could just take all of the individual event types actual text and create one big search and save it as eventtype=purchase</P> <P>If you would like to more easily handle this on a go forward basis you could start to tag your event types<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Tageventtypes">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Tageventtypes</A></P> Thu, 14 Jun 2012 02:32:14 GMT jerrad 2012-06-14T02:32:14Z https://community.splunk.com/t5/Knowledge-Management/eventtypes-combination/m-p/74480#M727 <P>Can we combine eventtypes based on a category? ie I have four eventtypes which fall into a specific category like purchase..so can I combine these four eventtypes into a single eventtype. If so, how i can i do it? And can you please provide an example for this.</P> <P>Thnx.</P> Wed, 13 Jun 2012 19:02:41 GMT https://community.splunk.com/t5/Knowledge-Management/eventtypes-combination/m-p/74480#M727 rakesh_498115 2012-06-13T19:02:41Z https://community.splunk.com/t5/Knowledge-Management/eventtypes-combination/m-p/74481#M728 <P>event types are really just mini saved searches, so you could simply take your 4 event types and place them into a search like</P> <P>eventtype=purchase-w OR eventtype=purchase-x OR eventtype=purchase-y OR eventtype=purchase-Z</P> <P>Then save this is as an event type called "purchase" so the next time you search you could simply type <CODE>eventtype=purchase</CODE></P> <P>or you could just take all of the individual event types actual text and create one big search and save it as eventtype=purchase</P> <P>If you would like to more easily handle this on a go forward basis you could start to tag your event types<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Tageventtypes">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Tageventtypes</A></P> Thu, 14 Jun 2012 02:32:14 GMT https://community.splunk.com/t5/Knowledge-Management/eventtypes-combination/m-p/74481#M728 jerrad 2012-06-14T02:32:14Z