JOIN how to save as an eventtype ?

[jermi001]

Hello Splunkers,

I'm using JOIN expression to classify a type of errors. I want to have all errors classified like an eventtype to make searches, charts easier to future users.

For example 2 events:
1.First event has got the name(for example=xError) of process and its ID_Number (for example = 999).
2.Second event has got an information about exception -> "Caught exception" and same ID_Number = 999.

Edit: I want to have second event marked as eventtype=xError.

My search:
index="test" Caught exception | JOIN ID_Number [searches index="test" xError]

How it export to eventtype or something else ? Message: Eventtype search string cannot be a search pipeline or contain a subsearch

I would like to have these results have in event type or as "intresting field". It is possible to do that? How ???

I would be grateful for help!!!

Regards

[jermi001]

Hello,

thank you for help, another question is, can I make a count chart by macros ? I mean I have for example many macros and I want to create a chart with numbers, how many logs was occurred in each macro

Regards 🙂

[gcusello]

hi jermi001,
at first I suggest to use (if possible) stats command instead join because join is very slow, something like this:

index="test" Caught exception 
| stats values(process) AS process values(information) AS information BY ID_Number

Anyway answering to your question, you cannot create an eventtype because there is one pipe, but as usefule workaround, you could create a macro containing your full search that you could use like an eventtype.
Obviously in this way you haven't all the fields of your index but only the ones that you put as values in your stats command.

Bye.
Giuseppe