topic Re: Eventtype recognition: When is the 'typer' command required? in Knowledge Management

Eventtype recognition: When is the 'typer' command required?

chris — Wed, 07 Mar 2012 08:50:56 GMT

I just noticed, that I have to add the 'typer' command to a search in a dashboard so my cusotm event renderer is active for non admin Users. Is there some documentation that explains when and how eventtypes are recognized?

Thanks

Chris

Re: Eventtype recognition: When is the 'typer' command required?

Stephen_Sorkin — Fri, 09 Mar 2012 03:08:09 GMT

This sounds like a bug. The typer is typically invoked automatically in the first search command. Do eventtypes show up properly in the search/flashtimeline view? If so, then there is probably a bug with required field propagation, which determines which fields must be extracted up front. You can fix this by adding "| fields *" or "| fields eventtype" after the first pipe to convince splunk to extract the eventtype.

Re: Eventtype recognition: When is the 'typer' command required?

chris — Fri, 09 Mar 2012 07:54:11 GMT

Of course, I forgot to add the eventtype to the fields that are propageted from the main search to the postprocessing search. Thank you.