Knowledge Management

eventtype error

michaelrosello
Path Finder

Why do I get this error when using eventtype?alt text

This is the eventtype configuration and I also tried running that search and it works fine.

alt text

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

what version are you on

0 Karma

michaelrosello
Path Finder

I'm on 6.6.2

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

First, check the index= and get rid of the space in it.

Second, it is possible that an unprintable/invisible character was put into the definition by cut-and-paste. This happens extremely often and is the hardest thing to identify. The solution is to retype the list manually, and see if that helps.

Third, if that didn't fix it, try each of the below with an IN clause that has only three items until you know the proper syntax is working.

 IN (20,30,50) 
 IN (20, 30, 50) 
 IN (20 30 50) 
 IN ("20","30","50")
 IN ("20", "30", "50")
 IN ("20" "30" "50")

All of the above should work, so we're trying to determine if there are additional undocumented limits when used in this manner.

Finally, if none of the above results in a working definition, check btool and see if you have a conflicting eventtype definition.

0 Karma

michaelrosello
Path Finder

Hmm I tried typing it manual IN(20, 30).

weirdly enough when I search index=myindex eventtype=AIOPS_COE_REPORT I still get the same error.

But when I search for just the index. i can see an eventtpe in my interesting field with the correct eventtype value which is the AIOPS_COE_REPORT

I also tried clicking it to add it to search, then I get again the same error.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@michaelrosello

Can you please share eventtype configuration ?

0 Karma

michaelrosello
Path Finder

@kamlesh_vaghela Hi, I've updated my question with the configuration.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@michaelrosello I've tried with your configuration but unable to reproduce this error. Your configurations looks proper. Can you please try to create new EventType with the same configuration? Just minor correction keep blank between IN and (.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...