I am making an app and wanted to have some dummy data tagged as an example to the end user.
So I have eventtypes.conf as
[installed_applications]
search = | inputlookup dummy_installed_applications
Now this search works as a standard search but will not work as an eventtype.
Any suggestions?
Eventtypes cannot contain pipes or subsearches.
Well, it's intrinsic to what an eventtype actually is:
It's a set of search filters that determines what eventtypes an event gets annotated with. You use it two ways - either to filter based on the eventtype, or to look at the eventtype field in events returned by any search.
A | inputlookup
doesn't make sense in this concept. Have you considered a macro?
Very unfortunate