Splunk Search

Disabling eventtypes on a per-query basis?

sowings
Splunk Employee
Splunk Employee

I've got a long-running search that's spending more time than necessary in command.search.typer. I say more time than necessary because I'm not referencing the eventtypes at all, whether as a field nor as part of my search string. I've tried the fields - eventtype strategy listed here, but I still see time spent in command.search.typer.

Anything else I can try to temporarily disable eventtypes?

(Splunk version is 4.3.6.)

Tags (1)
1 Solution

_d_
Splunk Employee
Splunk Employee

I suppose you can always do ...| fields [list of necessary fields ONLY] | ....

View solution in original post

_d_
Splunk Employee
Splunk Employee

I suppose you can always do ...| fields [list of necessary fields ONLY] | ....

sowings
Splunk Employee
Splunk Employee

Once I limited the search to just the fields I wanted, typer doesn't show up in job inspector. Thanks!

0 Karma

_d_
Splunk Employee
Splunk Employee

try this:

| fields - eventtype, tag::eventtype

0 Karma

sowings
Splunk Employee
Splunk Employee

Sadly, that doesn't work, either.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...