Splunk Search

Event Types not working

AccentureQBETA
Path Finder

I have loaded logs and can do the following search:

index=cms_cc_logs error

This returns 239 events.

If I do the below:

index=cms_cc_logs error |Typelearner

I get 6 suggestions.
If I know copy one of the searchs suggested, and search I get the same number of event back as TypeLearner said theer was..

If I added the same search, E.G: "punct::___[--]___*" error index::cms_cc_logs as an event. Manager > Event Type > New, I paste it in, add a tag HTTP and call it HTTPError

Now if I do the following searches, I get 0 matching results:

index=cms_cc_logs error eventtype="HTTPError"
or
eventtype="HTTPError"
or
index=cms_cc_logs eventtype="HTTPError"

I don't understand why.

I want to create 5-6 event types and then do a stacked graph for the number of each event type per hour or day. Splunk feels so painful at times 😞

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I think the eventtype you should be creating is

punct="___[--]___*" error index="cms_cc_logs"

Note the position of the quote characters. And although you might see evidence of the old "::" syntax in places like the eventtype builder, I think there's no reason not to use the more normal "=" syntax with the same fields.

If you created the eventtype with those quote characters around the actual "punct" field name as well, that will make Splunk search not for the punct value, but for the literal text in the indexed events of "punct::___[--]___", with a wildcard on the end. Since that text is not actually indexed in the raw event text, that's why it returns 0 events.

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

I think the eventtype you should be creating is

punct="___[--]___*" error index="cms_cc_logs"

Note the position of the quote characters. And although you might see evidence of the old "::" syntax in places like the eventtype builder, I think there's no reason not to use the more normal "=" syntax with the same fields.

If you created the eventtype with those quote characters around the actual "punct" field name as well, that will make Splunk search not for the punct value, but for the literal text in the indexed events of "punct::___[--]___", with a wildcard on the end. Since that text is not actually indexed in the raw event text, that's why it returns 0 events.

0 Karma

AccentureQBETA
Path Finder

Thank you 🙂

0 Karma

AccentureQBETA
Path Finder

I have also placed the events in the search app and only try and use them when i navigate to the search via apps.

I've also tried changing the permissions to global

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...