Splunk App for Web Analytics: Why am I getting "Eventtype 'brand-name' and 'internal-domain' not found or disabled" errors?

[rmsit]

Hello,

After installing Splunk App for Web Analytics and building the lookups for IIS data, I receive errors that these event types do not exist or they are disabled. The error originates from the indexer and I have the app installed on the search head. How do I resolve these errors?

[jbjerke_splunk · Accepted solution]

Hi James

There was some undeclared eventtypes in the latest release (1.3) that caused a warning message on the search head. The warning message does not affect the functionality of the app as these eventtypes are not used. I will fix this in the next release of the app.

As a workaround you can create a file called eventtypes.conf and place it here:

SPLUNK_HOME/etc/apps/SplunkAppForWebAnalytics/local

The contents should be this:

[visitor-type-direct]
search = eventtype=web-traffic referer="-" OR (NOT eventtype=visitor-type-paid) 

[external-referer]
search = eventtype=web-traffic NOT (referer="-" OR referer="*q=*" OR referer="*p=*" OR eventtype=social-*)

[internal-referer]
disabled=1

[search-referer]
search = eventtype=web-traffic NOT eventtype=direct-referer (referer="*q=*" OR referer="*p=*")

[socialmedia-referer]
search = eventtype=social-* NOT eventtype=direct-referer

j

[rmsit]

Hi Johan,

After upgrading to version 1.42 I am now receiving the errors below. Should I make the changes again that worked above?

1. Eventtype 'pageview' does not exist or is disabled.
2. Eventtype 'web-traffic' does not exist or is disabled.

Thanks,
James