Knowledge Management

eventtypes - disabled 1 or 0

MikeyG
Explorer

V4.2.3 - eventtypes not showing up after recent upgrade ...

There is this reference:
http://docs.splunk.com/Documentation/Splunk/4.2.3/Knowledge/Configureeventtypes

and then there is this:
http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Eventtypesconf

Boolean logic aside, which is disabled 1 or 0 ??

Tags (2)
0 Karma

gekoner
Communicator

Considering everything else in Splunk configuration files is disabled = 1, I'd go with that if you WANT TO DISABLE EventLogging.
You could always use disabled = true/false

Just to reiterate
true = 1
false= 0

crazydave
New Member

Skimming through docs and help I cannot see any clear statement that you can use true or false in place of 1 and 0.
Do you know if we can safely use 'true' / 'false' in all cases where '0' or '1' is in the examples/docs?
I'm guessing I'll see a parsing error on start up of the forwarder if 'true' or 'false' is not accepted in place of '0' or '1' ... not seen one yet.
Ta. David.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...