Knowledge Management

eventtypes - disabled 1 or 0

MikeyG
Explorer

V4.2.3 - eventtypes not showing up after recent upgrade ...

There is this reference:
http://docs.splunk.com/Documentation/Splunk/4.2.3/Knowledge/Configureeventtypes

and then there is this:
http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Eventtypesconf

Boolean logic aside, which is disabled 1 or 0 ??

Tags (2)
0 Karma

gekoner
Communicator

Considering everything else in Splunk configuration files is disabled = 1, I'd go with that if you WANT TO DISABLE EventLogging.
You could always use disabled = true/false

Just to reiterate
true = 1
false= 0

crazydave
New Member

Skimming through docs and help I cannot see any clear statement that you can use true or false in place of 1 and 0.
Do you know if we can safely use 'true' / 'false' in all cases where '0' or '1' is in the examples/docs?
I'm guessing I'll see a parsing error on start up of the forwarder if 'true' or 'false' is not accepted in place of '0' or '1' ... not seen one yet.
Ta. David.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...