Which are valid ways to create an event type? (select all that apply)

Splunk provides two primary methods for creating event types through the Splunk Web user interface. The first method is by navigating to the central management page via Settings > Event types and then selecting "New Event Type". The second, more direct method, is to create an event type from a search. After running a search, you can select an event, click on the "Event Actions" menu, and choose "Build Event Type". This pre-populates the event type definition with the search string that returned the selected event, streamlining the creation process.

A. The searchtypes command does not exist in Splunk SPL for the purpose of creating or managing event types.
B. Event types are defined in eventtypes.conf, not props.conf. The props.conf file is used for configuring data input properties like timestamping, line breaking, and field extractions.

1. Splunk Enterprise Documentation

Knowledge Manager Manual

"Create event types in Splunk Web": This section explicitly details the two correct UI-based methods for creating event types.

"You can create and edit event types through the Event Types page in Settings." (Corroborates option C).

"You can also create event types from events that you see in search results." (Corroborates option D).

2. Splunk Enterprise Documentation

Admin Manual

"eventtypes.conf": This document specifies the correct configuration file for event types.

"Use eventtypes.conf to define event types." This confirms that props.conf (option B) is incorrect for this purpose.

3. Splunk Enterprise Documentation

Search Reference

"Commands by category": A review of the command list in the official Search Reference confirms that a searchtypes command (option A) does not exist.