Knowledge Management
Highlighted

eventtype from an inputlookup

I am making an app and wanted to have some dummy data tagged as an example to the end user.

So I have eventtypes.conf as

[installed_applications]
search = | inputlookup dummy_installed_applications

Now this search works as a standard search but will not work as an eventtype.

Any suggestions?

Tags (2)
0 Karma
Highlighted

Re: eventtype from an inputlookup

SplunkTrust
SplunkTrust

Eventtypes cannot contain pipes or subsearches.

View solution in original post

Highlighted

Re: eventtype from an inputlookup

Very unfortunate

0 Karma
Highlighted

Re: eventtype from an inputlookup

SplunkTrust
SplunkTrust

Well, it's intrinsic to what an eventtype actually is:

It's a set of search filters that determines what eventtypes an event gets annotated with. You use it two ways - either to filter based on the eventtype, or to look at the eventtype field in events returned by any search.

A | inputlookup doesn't make sense in this concept. Have you considered a macro?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.