Knowledge Management

Problem with NULL eventtype w/ summary index

emechler
New Member

I have a summary index that is being populated correctly via a scheduled query (or so it would seem). Here's the scheduled query:

index=web sourcetype=weblog | sitimechart span=1day count BY eventtype usenull=f

If I lookup all of the entries in the summary index, I see events that contain the 2 available eventtypes (http_allow and http_deny). However, running a timechart query against the summary index only produces data with NULL eventtype:

index=summary | timechart span=1day count by orig_eventtype

(if I include the usenull=f option then I get no data returned). Running the analogous timechart query against the web index will produce the correct result:

index=web_proxy | timechart span=1day count by eventtype usenull=f

Any ideas why my summary index appears to be ignoring the eventtype?

Thank you!

Tags (2)
0 Karma

emechler
New Member

Went to the gym to clear my head... the problem was that even though the eventtype was being put into the summary index event, the eventtype knowledge object wasn't being attached to the event since the necessary kv objects weren't being brought over as well. I just setup a new eventtype specific to the summary index and that fixed the problem.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...