eventtype error

[michaelrosello]

Why do I get this error when using eventtype?

This is the eventtype configuration and I also tried running that search and it works fine.

[DalJeanis]

what version are you on

[michaelrosello]

I'm on 6.6.2

[DalJeanis]

First, check the index= and get rid of the space in it.

Second, it is possible that an unprintable/invisible character was put into the definition by cut-and-paste. This happens extremely often and is the hardest thing to identify. The solution is to retype the list manually, and see if that helps.

Third, if that didn't fix it, try each of the below with an IN clause that has only three items until you know the proper syntax is working.

 IN (20,30,50) 
 IN (20, 30, 50) 
 IN (20 30 50) 
 IN ("20","30","50")
 IN ("20", "30", "50")
 IN ("20" "30" "50")

All of the above should work, so we're trying to determine if there are additional undocumented limits when used in this manner.

Finally, if none of the above results in a working definition, check btool and see if you have a conflicting eventtype definition.

[michaelrosello]

Hmm I tried typing it manual IN(20, 30).

weirdly enough when I search index=myindex eventtype=AIOPS_COE_REPORT I still get the same error.

But when I search for just the index. i can see an eventtpe in my interesting field with the correct eventtype value which is the AIOPS_COE_REPORT

I also tried clicking it to add it to search, then I get again the same error.

[kamlesh_vaghela]

@michaelrosello

Can you please share eventtype configuration ?

[michaelrosello]

@kamlesh_vaghela Hi, I've updated my question with the configuration.

[kamlesh_vaghela]

@michaelrosello I've tried with your configuration but unable to reproduce this error. Your configurations looks proper. Can you please try to create new EventType with the same configuration? Just minor correction keep blank between IN and (.