topic Re: Disabling eventtypes on a per-query basis? in Splunk Search

Disabling eventtypes on a per-query basis?

sowings — Wed, 17 Jul 2013 14:36:18 GMT

I've got a long-running search that's spending more time than necessary in command.search.typer. I say more time than necessary because I'm not referencing the eventtypes at all, whether as a field nor as part of my search string. I've tried the fields - eventtype strategy listed here, but I still see time spent in command.search.typer.

Anything else I can try to temporarily disable eventtypes?

(Splunk version is 4.3.6.)

Re: Disabling eventtypes on a per-query basis?

_d_ — Wed, 17 Jul 2013 18:41:38 GMT

try this:

| fields - eventtype, tag::eventtype

Re: Disabling eventtypes on a per-query basis?

sowings — Wed, 17 Jul 2013 18:47:08 GMT

Sadly, that doesn't work, either.

Re: Disabling eventtypes on a per-query basis?

_d_ — Thu, 25 Jul 2013 15:14:46 GMT

I suppose you can always do ...| fields [list of necessary fields ONLY] | ....

Re: Disabling eventtypes on a per-query basis?

sowings — Thu, 25 Jul 2013 15:23:53 GMT

Once I limited the search to just the fields I wanted, typer doesn't show up in job inspector. Thanks!