Event Types not working

[AccentureQBETA]

I have loaded logs and can do the following search:

index=cms_cc_logs error

This returns 239 events.

If I do the below:

index=cms_cc_logs error |Typelearner

I get 6 suggestions.
If I know copy one of the searchs suggested, and search I get the same number of event back as TypeLearner said theer was..

If I added the same search, E.G: "punct::___[--]___*" error index::cms_cc_logs as an event. Manager > Event Type > New, I paste it in, add a tag HTTP and call it HTTPError

Now if I do the following searches, I get 0 matching results:

index=cms_cc_logs error eventtype="HTTPError"
or
eventtype="HTTPError"
or
index=cms_cc_logs eventtype="HTTPError"

I don't understand why.

I want to create 5-6 event types and then do a stacked graph for the number of each event type per hour or day. Splunk feels so painful at times 😞

[sideview · Accepted solution]

I think the eventtype you should be creating is

punct="___[--]___*" error index="cms_cc_logs"

Note the position of the quote characters. And although you might see evidence of the old "::" syntax in places like the eventtype builder, I think there's no reason not to use the more normal "=" syntax with the same fields.

If you created the eventtype with those quote characters around the actual "punct" field name as well, that will make Splunk search not for the punct value, but for the literal text in the indexed events of "punct::___[--]___", with a wildcard on the end. Since that text is not actually indexed in the raw event text, that's why it returns 0 events.

[AccentureQBETA]

Thank you 🙂

[AccentureQBETA]

I have also placed the events in the search app and only try and use them when i navigate to the search via apps.

I've also tried changing the permissions to global