Getting Data In

Is there anything I should do before using user defined eventtypes in a REST API call? Receiving error "Eventtype...does not exist or is disabled"

kmugglet
Communicator

Is there anything I should do before using user defined eventtype in a rest api call?

my username is svc_user_bob (real name changed to protect the innocent)

as svc_user_bob I created the following eventtype
Name:

sam_service.CombinedQueueGroupEgressLogRecord

Description:

eventtype=sam_data ds=service.CombinedQueueGroupEgressLogRecord

All well and good, I can return events of that eventtype.

When I do a rest call via curl

curl -k -u svc_user_bob:myFakePassword https://localhost:8089/services/search/jobs -d search="search eventtype=sam_service.CombinedQueueGroupEgressLogRecord"    

I get a SID which in job inspector shows as failed. On looking in the search log I get the following error

12-01-2014 18:00:08.615 WARN  StringSearchExpander - sid:1417417038.14 Eventtype 'sam_service.CombinedQueueGroupEgressLogRecord' does not exist or is disabled.

Why?

Other queries run via rest work OK but not this eventtype. I've deleted and created in several times just to make sure it's not a hanging config issue from some old eventtype with the same name.

0 Karma
1 Solution

kmugglet
Communicator

Turns out the eventtype didn't have sufficient permissions. Changed it to App visible and it works.

View solution in original post

0 Karma

kmugglet
Communicator

Turns out the eventtype didn't have sufficient permissions. Changed it to App visible and it works.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What happens when you use /servicesNS/svc_user_bob/your_app/search/jobs as the endpoint?

0 Karma

kmugglet
Communicator

Hi Martin, I'll give that a try. I managed to raise 2 questions at the same time, and had some luck answering it myself under http://answers.splunk.com/answers/200610/why-am-i-getting-error-eventtypedoes-not-exist-or.html

I did try your endpoint and got a list of search jobs.
I found that wrapping the eventtype name in quotes helped me.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...