eventtype BUG

[aholzel]

Hello,

Because I am not able to file a bug report via the "File a bug" link that is present in Splunk (I get a Salesforce error) I post it here in the hope that someone from Splunk can pick it up.

I believe I have found a bug in Splunk in eventtypes you can create via the GUI
Steps to reproduce:
- Go to Settings > Event types
- Create a New eventtype
- Give it a name with a space in it (the space is important because that is the trigger)
- Assign tags to it (also important to do because the tags are affected)
- Save (So far so good)
- Change the permissions van private to global

Once you change the permissions the tags are "gone" the tags are not moved to the "global" tags.conf file. If you do the above for a eventtype that does not have a space in the name the tags are moved to the "global" tags.conf file.
I think the problem is in the fact that in the eventtypes.conf file the stanza is creates as [test eventtype] ware as in the tags.conf the stanza is created as [eventtype=test%20eventtype] so the check to see if there are tags for an eventtype (or eventtypes for tags) fails.

So also if you change the permissions van global to private again the tags remain in the "global" tags.conf file.

Edit: I tested this in 6.2.2 and in 6.2.3

[aholzel · Accepted solution]

Via an colleague of mine we did get it under the attention of Splunk Support and they where able to reproduce it and gave it a bug number: SPL-104263

[dwaddle]

Not really an answer, but if you've found a bug the best thing to do is file a support case. While someone who can deal with the bug may see this post, it's far more likely it will get triaged correctly if there's a support case.

[grinabms]

The first part of the original post explains why he/she couldn't open a support case. I get the same error, namely when I click on "file a case", I get redirected to some odd error page telling me that my SSO cert failed, and I need to contact my salesforce.com administrator.

Is there a workaround for that error? I am trying to open a case (unrelated to the original poster's case)