eventtypes combination

[rakesh_498115]

Can we combine eventtypes based on a category? ie I have four eventtypes which fall into a specific category like purchase..so can I combine these four eventtypes into a single eventtype. If so, how i can i do it? And can you please provide an example for this.

Thnx.

[jerrad · Accepted solution]

event types are really just mini saved searches, so you could simply take your 4 event types and place them into a search like

eventtype=purchase-w OR eventtype=purchase-x OR eventtype=purchase-y OR eventtype=purchase-Z

Then save this is as an event type called "purchase" so the next time you search you could simply type eventtype=purchase

or you could just take all of the individual event types actual text and create one big search and save it as eventtype=purchase

If you would like to more easily handle this on a go forward basis you could start to tag your event types
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Tageventtypes