Knowledge Management

Eventtype recognition: When is the 'typer' command required?

chris
Motivator

I just noticed, that I have to add the 'typer' command to a search in a dashboard so my cusotm event renderer is active for non admin Users. Is there some documentation that explains when and how eventtypes are recognized?

Thanks

Chris

0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

This sounds like a bug. The typer is typically invoked automatically in the first search command. Do eventtypes show up properly in the search/flashtimeline view? If so, then there is probably a bug with required field propagation, which determines which fields must be extracted up front. You can fix this by adding "| fields *" or "| fields eventtype" after the first pipe to convince splunk to extract the eventtype.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

This sounds like a bug. The typer is typically invoked automatically in the first search command. Do eventtypes show up properly in the search/flashtimeline view? If so, then there is probably a bug with required field propagation, which determines which fields must be extracted up front. You can fix this by adding "| fields *" or "| fields eventtype" after the first pipe to convince splunk to extract the eventtype.

View solution in original post

chris
Motivator

Of course, I forgot to add the eventtype to the fields that are propageted from the main search to the postprocessing search. Thank you.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.