Eventtype recognition: When is the 'typer' command required?

[chris]

I just noticed, that I have to add the 'typer' command to a search in a dashboard so my cusotm event renderer is active for non admin Users. Is there some documentation that explains when and how eventtypes are recognized?

Thanks

Chris

[Stephen_Sorkin · Accepted solution]

This sounds like a bug. The typer is typically invoked automatically in the first search command. Do eventtypes show up properly in the search/flashtimeline view? If so, then there is probably a bug with required field propagation, which determines which fields must be extracted up front. You can fix this by adding "| fields *" or "| fields eventtype" after the first pipe to convince splunk to extract the eventtype.

[chris]

Of course, I forgot to add the eventtype to the fields that are propageted from the main search to the postprocessing search. Thank you.