<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How do I add an eventtype to my search in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191844#M55209</link>
    <description>&lt;P&gt;the event type displays the "gpu usage" field ..I want this field to be displayed along with other fields in search query&lt;/P&gt;</description>
    <pubDate>Mon, 24 Aug 2015 19:47:43 GMT</pubDate>
    <dc:creator>vrmandadi</dc:creator>
    <dc:date>2015-08-24T19:47:43Z</dc:date>
    <item>
      <title>How do I add an eventtype to my search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191840#M55205</link>
      <description>&lt;P&gt;How do I add an eventtype to a search? &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=rgs_windows sourcetype=process_details instance != "Idle" instance !="_Total" NOT instance="svchost*" NOT Username = "NT_AUTHORITY*"  Username != "SYSTEM" |  rex field=instance "(?&amp;lt;instance&amp;gt;[^#]+e)" | rex field=instance "(?&amp;lt;t;instance&amp;gt;[^~]+)" | lookup host_info.csv host OUTPUTNEW ip |stats latest(ElapsedHours) AS "ElapsedHours", avg(AdjustedPercentCPU) AS "Average CPU %" ,latest(instance) AS Process by ip,host |rename ip as IP |table host, IP ,Process, ElapsedHours, "Average CPU %",
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I want to add the eventtype below to the search above:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;eventtype="windows_performance" ip="*" site_description="*" object="NVIDIA GPU" counter="% GPU Usage"| stats sparkline(avg(Value)) as Trend avg(Value) as Average, max(Value) as Peak, latest(Value) as Current, latest(_time) as "Last Updated" by ip
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;can anyone please help me? thank you&lt;/P&gt;</description>
      <pubDate>Mon, 24 Aug 2015 15:56:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191840#M55205</guid>
      <dc:creator>vrmandadi</dc:creator>
      <dc:date>2015-08-24T15:56:17Z</dc:date>
    </item>
    <item>
      <title>Re: How do I add an eventtype to my search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191841#M55206</link>
      <description>&lt;P&gt;eventtype="windows_performance" with  your query.&lt;/P&gt;

&lt;P&gt;Add this eventtype in the app you are using.&lt;/P&gt;

&lt;P&gt;Go to settings -&amp;gt;Eventypes-&amp;gt;new&lt;/P&gt;</description>
      <pubDate>Mon, 24 Aug 2015 17:06:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191841#M55206</guid>
      <dc:creator>jensonthottian</dc:creator>
      <dc:date>2015-08-24T17:06:19Z</dc:date>
    </item>
    <item>
      <title>Re: How do I add an eventtype to my search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191842#M55207</link>
      <description>&lt;P&gt;no the above event type is already a saved event type but i want to use that in the search query&lt;/P&gt;</description>
      <pubDate>Mon, 24 Aug 2015 17:49:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191842#M55207</guid>
      <dc:creator>vrmandadi</dc:creator>
      <dc:date>2015-08-24T17:49:37Z</dc:date>
    </item>
    <item>
      <title>Re: How do I add an eventtype to my search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191843#M55208</link>
      <description>&lt;P&gt;can you confirm what eventtype="windows_performance" corresponds to ? the search query for the eventtype please.&lt;/P&gt;</description>
      <pubDate>Mon, 24 Aug 2015 18:50:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191843#M55208</guid>
      <dc:creator>jensonthottian</dc:creator>
      <dc:date>2015-08-24T18:50:49Z</dc:date>
    </item>
    <item>
      <title>Re: How do I add an eventtype to my search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191844#M55209</link>
      <description>&lt;P&gt;the event type displays the "gpu usage" field ..I want this field to be displayed along with other fields in search query&lt;/P&gt;</description>
      <pubDate>Mon, 24 Aug 2015 19:47:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191844#M55209</guid>
      <dc:creator>vrmandadi</dc:creator>
      <dc:date>2015-08-24T19:47:43Z</dc:date>
    </item>
    <item>
      <title>Re: How do I add an eventtype to my search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191845#M55210</link>
      <description>&lt;P&gt;worked for me... actually was searching how to add field "event type".. got an answer from your reply.&lt;/P&gt;

&lt;P&gt;Thanks again.&lt;/P&gt;</description>
      <pubDate>Wed, 16 Sep 2015 12:09:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-an-eventtype-to-my-search/m-p/191845#M55210</guid>
      <dc:creator>marees123</dc:creator>
      <dc:date>2015-09-16T12:09:31Z</dc:date>
    </item>
  </channel>
</rss>

