I have a eventtype, for example, Defect-123, defined with search string from stack trace "caused by: some exception", I can use the eventtype to find the event, but when look at the eventtype field for that particular event, I can not see the Defect-123.
This only works when I build search string with some string from log entry but not the string from stack trace appended for that log entry....
What could be the reason for this? The size of the stack trace, or some pattern need to be defined....
When you say "I can't see the eventtype in the result," where are you looking for the eventtype? And what are you trying to achieve with the result?
If you are looking in the fields sidebar for the eventtype, only the top 10 eventtypes will show even though there might be more.
The "eventtype" field is often a multivalued field, which will show all the eventtypes (think "categories") that an event belongs to.
Try this and see what happens:
| stats count by eventtype
You may see many different eventtypes for a single event. Assume that your search returned 10 results. The statistics could easily look like this