Why does search complain about eventtype errors when no eventtype is used?

[nsommars]

Hi, and sorry for the somewhat fuzzy question!
I'll try to explain the scenario, so bare with me if the explanation gets a bit long 😉

We have lots of eventtypes in our environment, where most of them are defined within specific apps.
The problem here is that when I (or anyone for that matter) run a search from the standard search tab, the job result complains that one particular eventtype is missing or disabled. This eventtype is defined within a specific app, but is never used in the query.

Example, search executed in the "standard" search and reporting app space:
index=network "10.20.30.40" <-- No eventtype used!
The search query displays all results containing 10.20.30.40 - as expected, but the job-inspector complains that "eventtype login_failure_wdm does not exist or is disabled".

This error would make sense if I tried to use this particular eventtype (since I am running the query outside the app where the eventtype is defined), but no eventtype is used!
As expected there are no complaints if I run the same query from within the app space where login_failure_wdm is defined.
The thing is that it does not matter what indexes and searches I do - the error is there.

The eventtype in question is "nested" from another eventtype, but we use a lot of those without any issues.

login_failure_wdm: eventtype=wdm "authorization error"
where 'wdm' is an eventtype defined as:
index=network host=itc*wdm*

This environment consists of a 2 node indexer cluster (+ 1 master node) and one searchhead (where all searches are performed).

I have run a recursive grep through the entire config on my searchhead, cluster master and the indexer servers, but the eventtype is not included anywhere (except for the definition of the eventtype itself) on the searchhead.

Has anyone seen this phenomena, and found a solution?

[FrankVl]

Even though you are not querying for a specific eventtype, the eventtype config is of course still applied to the events that are returned by the search, right. To set the relevant eventtypes and tags.

Does the context where you execute this search have any tags active that refer to this eventtype?

[nsommars]

Nope, there are no tags related to this eventtype in the app space where this error occurs.
There are just a few tags in this app, and all of them are just referring to different hosts.

[lakshman239]

what's the scope of the eventtype definition for eventtype login_failure_wdm? check in local.meta for permissions. from what you say, it needs to be 'app' specific and not global.

[nsommars]

Yes it is app specific. The question is however the other way around - I don't use the eventtype, but it still gives warnings that an eventtype (that I don't use) is not defined.

[mohdmikhael]

Hi @nsommars, 

Just wondering if your issue was resolved? I'm actually facing something similar at the moment.

Regards,

Mikhael