Splunk Search

Managing Eventtypes and Tags

Yancy
Path Finder

Any recommended best practices for managing eventtypes and their corresponding tags?

I've found the Splunk Common Information Model to be fairly helpful in starting a taxonomy.

I've also been using the following search to review events and their tags

*  | dedup eventtype | fields eventtype, tag::eventtype

Any other recommendations, best practices, thoughts?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Why not just use the event types admin page?

http://localhost:8000/en-US/manager/search/saved/eventtypes

(adjust the base URL for your Splunk install, of course).

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Why not just use the event types admin page?

http://localhost:8000/en-US/manager/search/saved/eventtypes

(adjust the base URL for your Splunk install, of course).

Yancy
Path Finder

Thanks gkanapathy!

I forgot all about this. I was thinking along the lines of a report of some sort (maybe similar to eventtyper), but this will help.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...