Can we combine eventtypes based on a category? ie I have four eventtypes which fall into a specific category like purchase..so can I combine these four eventtypes into a single eventtype. If so, how i can i do it? And can you please provide an example for this.
Thnx.
event types are really just mini saved searches, so you could simply take your 4 event types and place them into a search like
eventtype=purchase-w OR eventtype=purchase-x OR eventtype=purchase-y OR eventtype=purchase-Z
Then save this is as an event type called "purchase" so the next time you search you could simply type eventtype=purchase
or you could just take all of the individual event types actual text and create one big search and save it as eventtype=purchase
If you would like to more easily handle this on a go forward basis you could start to tag your event types
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Tageventtypes
event types are really just mini saved searches, so you could simply take your 4 event types and place them into a search like
eventtype=purchase-w OR eventtype=purchase-x OR eventtype=purchase-y OR eventtype=purchase-Z
Then save this is as an event type called "purchase" so the next time you search you could simply type eventtype=purchase
or you could just take all of the individual event types actual text and create one big search and save it as eventtype=purchase
If you would like to more easily handle this on a go forward basis you could start to tag your event types
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Tageventtypes