Knowledge Management
Highlighted

eventtype error

Path Finder

Why do I get this error when using eventtype?alt text

This is the eventtype configuration and I also tried running that search and it works fine.

alt text

0 Karma
Highlighted

Re: eventtype error

SplunkTrust
SplunkTrust

@michaelrosello

Can you please share eventtype configuration ?

0 Karma
Highlighted

Re: eventtype error

Path Finder

@kamlesh_vaghela Hi, I've updated my question with the configuration.

0 Karma
Highlighted

Re: eventtype error

SplunkTrust
SplunkTrust

@michaelrosello I've tried with your configuration but unable to reproduce this error. Your configurations looks proper. Can you please try to create new EventType with the same configuration? Just minor correction keep blank between IN and (.

0 Karma
Highlighted

Re: eventtype error

SplunkTrust
SplunkTrust

First, check the index= and get rid of the space in it.

Second, it is possible that an unprintable/invisible character was put into the definition by cut-and-paste. This happens extremely often and is the hardest thing to identify. The solution is to retype the list manually, and see if that helps.

Third, if that didn't fix it, try each of the below with an IN clause that has only three items until you know the proper syntax is working.

 IN (20,30,50) 
 IN (20, 30, 50) 
 IN (20 30 50) 
 IN ("20","30","50")
 IN ("20", "30", "50")
 IN ("20" "30" "50")

All of the above should work, so we're trying to determine if there are additional undocumented limits when used in this manner.

Finally, if none of the above results in a working definition, check btool and see if you have a conflicting eventtype definition.

0 Karma
Highlighted

Re: eventtype error

Path Finder

Hmm I tried typing it manual IN(20, 30).

weirdly enough when I search index=myindex eventtype=AIOPSCOEREPORT I still get the same error.

But when I search for just the index. i can see an eventtpe in my interesting field with the correct eventtype value which is the AIOPSCOEREPORT

I also tried clicking it to add it to search, then I get again the same error.

0 Karma
Highlighted

Re: eventtype error

SplunkTrust
SplunkTrust

what version are you on

0 Karma
Highlighted

Re: eventtype error

Path Finder

I'm on 6.6.2

0 Karma