V4.2.3 - eventtypes not showing up after recent upgrade ...
There is this reference:
http://docs.splunk.com/Documentation/Splunk/4.2.3/Knowledge/Configureeventtypes
and then there is this:
http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Eventtypesconf
Boolean logic aside, which is disabled 1 or 0 ??
Considering everything else in Splunk configuration files is disabled = 1, I'd go with that if you WANT TO DISABLE EventLogging.
You could always use disabled = true/false
Just to reiterate
true = 1
false= 0
Skimming through docs and help I cannot see any clear statement that you can use true or false in place of 1 and 0.
Do you know if we can safely use 'true' / 'false' in all cases where '0' or '1' is in the examples/docs?
I'm guessing I'll see a parsing error on start up of the forwarder if 'true' or 'false' is not accepted in place of '0' or '1' ... not seen one yet.
Ta. David.