Has anyone ran into Eventtype "xxxxxxxxx" does not exist or is disabled. Search results only for a certain period?

[mohdmikhael]

Hi,

My client has encountered the following issue below and I was just wondering if anyone has encountered something similar?

- Encountered the following error eventtype "xxxxxxxxx" does not exist or is disabled when running a search using a specific index/sourcetype. They have mentioned that the affected eventtype has the proper permissions.

- Search is able to return results for a shorter timeframe (ie 3 months) as compared to a longer timeframe (1 year).

Thank you in advance for any information given 🙂

Mikhael

[mohdmikhael]

Hi @gcusello,

Thank you for the reply. Can I check how would I go about checking the grants on this eventtype of my roles and giving Global grants? Is it under "Permissions" of the specific affected eventtype? E.g. Settings > Eventtypes > Search for affected eventtype and click on Permissions?

Thank you.

Mikhael

[gcusello]

Hi @mohdmikhael,

yes, exactly: you have to check if your user has the permissions to read the eventtype.

Then, in in your eventtype there are other knowledhe objects (other eventtypes, tags, fields, etc...) you have to check the permissions of each of them.

Ciao.

Giuseppe

[mohdmikhael]

Hi @gcusello,

Thank you for the reply. Yes, I have checked the permissions for the affected eventtype and it shows as follows:

Under Everyone, it shows as ticked for Read

Under Search string, it shows as sourcetype = xxxxx  app = xxxxx

Would I need to check the app permissions for this?

Thank you in advance.

Mikhael

[gcusello]

Hi @mohdmikhael,

is there in the eventtype the index definition?

if not try to add it because the index for search couldn't be in the default path.

Ciao.

Giuseppe

[mohdmikhael]

Hi @gcusello,

I have checked further on this with my customer and it seems that it is affecting only certain users. Also, these certain users are only able to search up to a certain time range e.g. 3 months as compared to 1 year.

Can I just check as to why this is happening?

Thank you.

[gcusello]

Hi @mohdmikhael,

identify if the users affected by the problem has a different role that propably hasn't the access to indexes or knowledge objects  (as eventtypes).

ciao.

Giuseppe

[gcusello]

Hi @mohdmikhael,

eventtypes are defined at search time, this means that an eventtype must exist when the search is runned even if it's related to old data when the eventtype was present..

If your problem is that the eventtype is present but it isn't read, you have to check the grants on this eventtype of your roles and eventually give Global grants on it.

Ciao.

Giuseppe