https://community.splunk.com/t5/Knowledge-Management/eventtypes-disabled-1-or-0/m-p/77860#M758 <P>Skimming through docs and help I cannot see any clear statement that you can use true or false in place of 1 and 0.<BR /> Do you know if we can safely use 'true' / 'false' in all cases where '0' or '1' is in the examples/docs?<BR /> I'm guessing I'll see a parsing error on start up of the forwarder if 'true' or 'false' is not accepted in place of '0' or '1' ... not seen one yet.<BR /> Ta. David.</P> Fri, 30 Jan 2015 10:45:21 GMT crazydave 2015-01-30T10:45:21Z https://community.splunk.com/t5/Knowledge-Management/eventtypes-disabled-1-or-0/m-p/77858#M756 <P>V4.2.3 - eventtypes not showing up after recent upgrade ... </P> <P>There is this reference:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/4.2.3/Knowledge/Configureeventtypes">http://docs.splunk.com/Documentation/Splunk/4.2.3/Knowledge/Configureeventtypes</A></P> <P>and then there is this:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Eventtypesconf">http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Eventtypesconf</A></P> <P>Boolean logic aside, which is disabled 1 or 0 ??</P> Mon, 19 Sep 2011 16:25:54 GMT https://community.splunk.com/t5/Knowledge-Management/eventtypes-disabled-1-or-0/m-p/77858#M756 MikeyG 2011-09-19T16:25:54Z https://community.splunk.com/t5/Knowledge-Management/eventtypes-disabled-1-or-0/m-p/77859#M757 <P>Considering everything else in Splunk configuration files is disabled = 1, I'd go with that if you WANT TO DISABLE EventLogging.<BR /> You could always use disabled = true/false</P> <P>Just to reiterate <BR /> true = 1 <BR /> false= 0</P> Mon, 19 Sep 2011 18:31:18 GMT https://community.splunk.com/t5/Knowledge-Management/eventtypes-disabled-1-or-0/m-p/77859#M757 gekoner 2011-09-19T18:31:18Z https://community.splunk.com/t5/Knowledge-Management/eventtypes-disabled-1-or-0/m-p/77860#M758 <P>Skimming through docs and help I cannot see any clear statement that you can use true or false in place of 1 and 0.<BR /> Do you know if we can safely use 'true' / 'false' in all cases where '0' or '1' is in the examples/docs?<BR /> I'm guessing I'll see a parsing error on start up of the forwarder if 'true' or 'false' is not accepted in place of '0' or '1' ... not seen one yet.<BR /> Ta. David.</P> Fri, 30 Jan 2015 10:45:21 GMT https://community.splunk.com/t5/Knowledge-Management/eventtypes-disabled-1-or-0/m-p/77860#M758 crazydave 2015-01-30T10:45:21Z