Hello,
After installing Splunk App for Web Analytics and building the lookups for IIS data, I receive errors that these event types do not exist or they are disabled. The error originates from the indexer and I have the app installed on the search head. How do I resolve these errors?
Hi James
There was some undeclared eventtypes in the latest release (1.3) that caused a warning message on the search head. The warning message does not affect the functionality of the app as these eventtypes are not used. I will fix this in the next release of the app.
As a workaround you can create a file called eventtypes.conf and place it here:
SPLUNK_HOME/etc/apps/SplunkAppForWebAnalytics/local
The contents should be this:
[visitor-type-direct]
search = eventtype=web-traffic referer="-" OR (NOT eventtype=visitor-type-paid)
[external-referer]
search = eventtype=web-traffic NOT (referer="-" OR referer="*q=*" OR referer="*p=*" OR eventtype=social-*)
[internal-referer]
disabled=1
[search-referer]
search = eventtype=web-traffic NOT eventtype=direct-referer (referer="*q=*" OR referer="*p=*")
[socialmedia-referer]
search = eventtype=social-* NOT eventtype=direct-referer
j
Hi James
There was some undeclared eventtypes in the latest release (1.3) that caused a warning message on the search head. The warning message does not affect the functionality of the app as these eventtypes are not used. I will fix this in the next release of the app.
As a workaround you can create a file called eventtypes.conf and place it here:
SPLUNK_HOME/etc/apps/SplunkAppForWebAnalytics/local
The contents should be this:
[visitor-type-direct]
search = eventtype=web-traffic referer="-" OR (NOT eventtype=visitor-type-paid)
[external-referer]
search = eventtype=web-traffic NOT (referer="-" OR referer="*q=*" OR referer="*p=*" OR eventtype=social-*)
[internal-referer]
disabled=1
[search-referer]
search = eventtype=web-traffic NOT eventtype=direct-referer (referer="*q=*" OR referer="*p=*")
[socialmedia-referer]
search = eventtype=social-* NOT eventtype=direct-referer
j
Hi Johan,
After upgrading to version 1.42 I am now receiving the errors below. Should I make the changes again that worked above?
Thanks,
James