How to use priority of EventTypes as criteria ?

[woodreamz]

Hello,

I have configured Event Types in Splunk to identify all errors with a tag (it's easier to understand than stacktrace).
But I would like to make queries on the Event type priority (if its possible).

Example: ("ERROR-" OR "WARN-") AND priority=1

Anyone knows how to do that ?

Thx

[hazekamp · Accepted solution]

Woodreamz,

Eventtype priority in eventtypes.conf is not a searchable element.

priority = <integer, 1 through 10>
* Value used to determine the order in which the matching eventtypes of an event are displayed.  
* 1 is the highest and 10 is the lowest priority. 

Instead, I would recommend creating a lookup which maps eventtype or other event characteristics to a priority field. Example:

## eventtypes.conf
[myeventtype]
search = ERROR OR WARN

## transforms.conf
[eventtype_priority_lookup]
filename = eventtype_priorities.csv

## eventtype_priorities.csv
eventtype,priority
myeventtype,super-critical

## search
ERROR OR WARN | lookup eventtype_priority_lookup eventtype OUTPUT priority | search priority=super-critical

The only downside to performing a lookup on eventtype is that the eventtype field is not available until after the initial search. So we perform an initial search to narrow down our events, then perform the lookup, and then perform a search on the output field of the lookup. You could not use this lookup in props.conf for instance.

You could also use tags for this, however tags can be a bit cumbersome to report on as a field.

##tags.conf
[eventtype=myeventtype]
super-critical = enabled

## search
tag=super-critical