How to add eventtype to search results?

[gunslinger]

I need to understand which event types each search result record belongs to.

My search:

index="a" AND eventtype="*"

I want the results to contain a field with a list of matching event types.

It would be ok for me to have a table with columns _raw and eventtypes.

We have 10k+ event types and thousands of events.

Is it possible to achieve?

Thanks.

[gcusello · Accepted solution]

Hi @gunslinger,

your requirement isn't so clear for me, could you better describe it?

it seems that you want a table with the raw events and the eventtypes defined for each event.

If this is your requirement, you could try something like this:

index="a" eventtype="*"
| table eventtype _raw

but is this what you want?

Ciao.

Giuseppe

[gunslinger]

thank you, for some reason I thought I need some special expression to get the event type as a field

[ITWhisperer]

Are you saying that each event may have more than one event type?

Have these event types already been extracted or are you asking for help to extract them?

It might be useful if you could share some anonymised events (in a code block </> to preserve formatting etc.)