Implementing Splunk 7, Third Edition - Third Edition

Using event types to group results

Another approach for grouping results to reduce the summary index size would be to use event types in creative ways. For a refresher on event types, see Chapter 7, Extending Search.

This approach has the following advantages:

• All definitions are defined through the web interface
• It is possible to create arbitrarily complex definitions
• You can easily search for only those events that have defined section names
• You can place events in multiple groups if desired

The disadvantages to this approach are as follows:

• This is a non-obvious approach.
• It is inconvenient to not place events in multiple groups if more than one event type matches. For instance, if you want a page to match /product/x/* but not /product/* ...