Skip to content

adding saved event types feature#90

Closed
peter-k-r wants to merge 1 commit intosplunk:masterfrom
peter-k-r:master
Closed

adding saved event types feature#90
peter-k-r wants to merge 1 commit intosplunk:masterfrom
peter-k-r:master

Conversation

@peter-k-r
Copy link

Resource: splunk_saved_eventtypes

Create and manage saved searches.

Example Usage

resource "splunk_saved_event_types" "test" {
    name        = "test"
    description = "Test New event description"
    disabled 	= "0"
    priority 	= 1
    search 		= "index=main"
    color		= "blue"
    tags 		= "tag"
    acl {
      owner = "admin"
      sharing = "app"
      app = "launcher"
    }
}

Argument Reference

For latest resource argument reference: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#saved.2Feventtypes

This resource block supports the following arguments:

  • name - (Required) A name for the event type.
  • description - (Optional) Human-readable description of this event type.
  • search - (Required) Event type search string.
  • color- (Optional) Color for this event type. The supported colors are: none, et_blue, et_green, et_magenta, et_orange, et_purple, et_red, et_sky, et_teal, et_yellow.
  • disabled - (Optional) If True, disables the event type.
  • priority - (Optional) Specify an integer from 1 to 10 for the value used to determine the order in which the matching event types of an event are displayed. 1 is the highest priority.
  • tags - (Optional) [Deprecated] Use tags.conf.spec file to assign tags to groups of events with related field values.
  • acl - (Optional) The app/user context that is the namespace for the resource

Attribute Reference

In addition to all arguments above, This resource block exports the following arguments:

  • id - The ID of the saved search event type

@dlandtwing
Copy link

I would love to see support for event types in the provider.
The PR is still mergeable and the resource works fine. Is there anything I can do to help so that this PR is merged?

@peter-k-r
Copy link
Author

Is there anything I can do to help so that this PR is merged?
Thanks for looking at this, I made this 3 years ago for a client, If we could find a reviewer I would be happy to have this merged to master (I was unsure on how this worked in this PR - so I just left it alone).

@rrossetti-splunk rrossetti-splunk mentioned this pull request Mar 19, 2026
@rrossetti-splunk
Copy link
Collaborator

Added in #222
Thank you for your contribution

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants