eventtype from an inputlookup

[phoenixdigital]

I am making an app and wanted to have some dummy data tagged as an example to the end user.

So I have eventtypes.conf as

[installed_applications]
search = | inputlookup dummy_installed_applications

Now this search works as a standard search but will not work as an eventtype.

Any suggestions?

[martin_mueller · Accepted solution]

Eventtypes cannot contain pipes or subsearches.

[martin_mueller]

Well, it's intrinsic to what an eventtype actually is:

It's a set of search filters that determines what eventtypes an event gets annotated with. You use it two ways - either to filter based on the eventtype, or to look at the eventtype field in events returned by any search.

A | inputlookup doesn't make sense in this concept. Have you considered a macro?

[phoenixdigital]

Very unfortunate