<%inherit file="//layout/base.html" /> <%namespace name="lib" file="//lib.html" import="*" />

${_('Build Eventtype')}

% if len(successmessage) == 0: % for msg in messages: ${msg} % endfor % endif

${_('Generated eventtype')}

    ${eventtype|h}
% if len(eventtype)> 0 and testingurl != None: % endif
% if edited:

% elif eventValues:
${_('Eventtype Features')} % for attr in fieldOrder:
    <% i = 0 %> <% val = eventValues[attr] %> % for subval in val: <% i += 1 %> <% countstr = "%.2d" % i %> <% checked = '' %> <% if attr in checkedValues and str(subval) in checkedValues[attr]: checked = 'checked="checked"' %>
  • ${attr|h}=${subval|h}
  • % endfor % if attr in fieldValues and fieldValues[attr] != None and len(fieldValues[attr]['modes']) > 1: <% altvalues = [vd['value'] for vd in fieldValues[attr]['modes'] if vd['value'] not in val] %> % if len(altvalues) > 0:
      ${_('  Alternative values:')}
        % for altval in altvalues: <% checked = '' %> <% i += 1 %> <% countstr = "%.2d" % i %> <% if attr in checkedValues and altval in checkedValues[attr]: checked = 'checked="checked"' %>
      • ${altval|h}
      • % endfor
    % endif % endif
% endfor
% endif

${_('Sample events')}

${_('This list is based on the event you selected from your search and the eventtype built.')}

% for event in events: % endfor
${event}

${_('Save Eventtype')}

Note: To ensure the eventtype works properly, test before you save it.

${_('Edit Eventtype')}

${_('Test Eventtype')}

A new Splunk search window will open and allow you to verify that your eventtype returns the events you want.

When you are done testing your eventtype, close the search testing window and return to the Build Eventtype window to save your eventtype or further refine it.

${_('Successfully Saved Eventtype')}

${_('Your eventtype has been saved.')}