Splunk Search

Event Types not working

AccentureQBETA
Path Finder

I have loaded logs and can do the following search:

index=cms_cc_logs error

This returns 239 events.

If I do the below:

index=cms_cc_logs error |Typelearner

I get 6 suggestions.
If I know copy one of the searchs suggested, and search I get the same number of event back as TypeLearner said theer was..

If I added the same search, E.G: "punct::___[--]___*" error index::cms_cc_logs as an event. Manager > Event Type > New, I paste it in, add a tag HTTP and call it HTTPError

Now if I do the following searches, I get 0 matching results:

index=cms_cc_logs error eventtype="HTTPError"
or
eventtype="HTTPError"
or
index=cms_cc_logs eventtype="HTTPError"

I don't understand why.

I want to create 5-6 event types and then do a stacked graph for the number of each event type per hour or day. Splunk feels so painful at times 😞

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I think the eventtype you should be creating is

punct="___[--]___*" error index="cms_cc_logs"

Note the position of the quote characters. And although you might see evidence of the old "::" syntax in places like the eventtype builder, I think there's no reason not to use the more normal "=" syntax with the same fields.

If you created the eventtype with those quote characters around the actual "punct" field name as well, that will make Splunk search not for the punct value, but for the literal text in the indexed events of "punct::___[--]___", with a wildcard on the end. Since that text is not actually indexed in the raw event text, that's why it returns 0 events.

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

I think the eventtype you should be creating is

punct="___[--]___*" error index="cms_cc_logs"

Note the position of the quote characters. And although you might see evidence of the old "::" syntax in places like the eventtype builder, I think there's no reason not to use the more normal "=" syntax with the same fields.

If you created the eventtype with those quote characters around the actual "punct" field name as well, that will make Splunk search not for the punct value, but for the literal text in the indexed events of "punct::___[--]___", with a wildcard on the end. Since that text is not actually indexed in the raw event text, that's why it returns 0 events.

0 Karma

AccentureQBETA
Path Finder

Thank you 🙂

0 Karma

AccentureQBETA
Path Finder

I have also placed the events in the search app and only try and use them when i navigate to the search via apps.

I've also tried changing the permissions to global

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...