Monitoring Splunk

All eventtypes in eventtypes.conf not found in btool search

jwhughes58
Contributor

This is my local/eventtypes.conf file

[juniper_sslvpn_auth]
search = sourcetype=juniper_sslvpn_mag "authentication successful" OR "authentication failed"

[juniper_sslvpn_authz]
priority = 6
search = sourcetype=juniper_sslvpn_mag "WebRequest Completed" OR "Closed Connection"

[juniper_sslvpn_auth_failed]
priority = 5
search = index=vpn sourcetype=juniper:sslvpn "Primary authentication failed"

[juniper_sslvpn_auth_successful]
priority = 5
search = index=vpn sourcetype=juniper:sslvpn "Primary authentication successful"

[juniper_sslvpn_webrequest]
priority = 5
search = index=vpn sourcetype=juniper:sslvpn "WebRequest"

[juniper_sslvpn_webrequest_sso_successful]
priority = 5
search = index=vpn sourcetype=juniper:sslvpn "Web SSO: Authentication successful"

The juniper_sslvpn_mag eventtypes are disabled. When I run

/apps/splunk/bin/splunk btool eventtypes list | less

and grep for juniper, all I get is

[juniper_sslvpn_auth_failed]
color = 
description = 
disabled = 0
priority = 5
search = index=vpn sourcetype=juniper:sslvpn "Primary authentication failed"
tags = 
[juniper_sslvpn_auth_successful]
color = 
description = 
disabled = 0
priority = 5
search = index=vpn sourcetype=juniper:sslvpn "Primary authentication successful"
tags = 
[juniper_sslvpn_webrequest]
color = 
description = 
disabled = 0
priority = 5
search = index=vpn sourcetype=juniper:sslvpn "WebRequest"
tags = 

I can't see any reason why the final stanza in local/eventtypes.conf is not found by btool. Any ideas?

TIA,
Joe

1 Solution

koshyk
Super Champion

Have a try by

$SPLUNK_HOME/bin/splunk cmd btool eventtypes list --debug > /tmp/eventtypes.btool 

and then physically check in the output file to see if anything missing.

View solution in original post

0 Karma

koshyk
Super Champion

Have a try by

$SPLUNK_HOME/bin/splunk cmd btool eventtypes list --debug > /tmp/eventtypes.btool 

and then physically check in the output file to see if anything missing.

0 Karma

jwhughes58
Contributor

Hi Koshyk,

The debug option helped me figure out what is going on with the eventtypes.conf. I have a precedence issue I have to figure out. Another day of learning. Nice to know about the --debug option.

Joe

koshyk
Super Champion

thanks mate. I've put it an answer , if you can please upvote/accept it.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...