Knowledge Management

eventtype BUG

aholzel
Communicator

Hello,

Because I am not able to file a bug report via the "File a bug" link that is present in Splunk (I get a Salesforce error) I post it here in the hope that someone from Splunk can pick it up.

I believe I have found a bug in Splunk in eventtypes you can create via the GUI
Steps to reproduce:
- Go to Settings > Event types
- Create a New eventtype
- Give it a name with a space in it (the space is important because that is the trigger)
- Assign tags to it (also important to do because the tags are affected)
- Save (So far so good)
- Change the permissions van private to global

Once you change the permissions the tags are "gone" the tags are not moved to the "global" tags.conf file. If you do the above for a eventtype that does not have a space in the name the tags are moved to the "global" tags.conf file.
I think the problem is in the fact that in the eventtypes.conf file the stanza is creates as [test eventtype] ware as in the tags.conf the stanza is created as [eventtype=test%20eventtype] so the check to see if there are tags for an eventtype (or eventtypes for tags) fails.

So also if you change the permissions van global to private again the tags remain in the "global" tags.conf file.

Edit: I tested this in 6.2.2 and in 6.2.3

Tags (3)
0 Karma
1 Solution

aholzel
Communicator

Via an colleague of mine we did get it under the attention of Splunk Support and they where able to reproduce it and gave it a bug number: SPL-104263

View solution in original post

aholzel
Communicator

Via an colleague of mine we did get it under the attention of Splunk Support and they where able to reproduce it and gave it a bug number: SPL-104263

dwaddle
SplunkTrust
SplunkTrust

Not really an answer, but if you've found a bug the best thing to do is file a support case. While someone who can deal with the bug may see this post, it's far more likely it will get triaged correctly if there's a support case.

0 Karma

grinabms
Explorer

The first part of the original post explains why he/she couldn't open a support case. I get the same error, namely when I click on "file a case", I get redirected to some odd error page telling me that my SSO cert failed, and I need to contact my salesforce.com administrator.

Is there a workaround for that error? I am trying to open a case (unrelated to the original poster's case)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...