Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow these steps to define an event type and associated tag:

1. Log in to your Splunk server.

2. From the home launcher in the top right-hand corner, click on the Settings menu item and then click on the Event types link:
   
3. Click on the New button.
4. In the Destination App dropdown, select search. Enter HttpRequest-Success in the Name field. In the Search string text area, enter sourcetype=access_combined status=2*. In the Tag(s) field, enter webserver and then click on Save:
   
5. The event type is now created. To verify that this worked, ...