Tag event types
This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4
Contents
Tag event types
Event types can be tagged to add information to your data. Any event type can have multiple tags. For example, you can tag all firewall events as firewall, tag a subset as deny and tag another subset as allow. Once an event type is tagged, any event type matching the tagged pattern will also be tagged.
IMPORTANT: An event type must be discovered or saved in order to be tagged.
Configuration
You can tag an event type from within SplunkWeb. Make sure you have enable the eventtype field from the fields drop down menu.
- Click on the drop-down arrow next to the eventtype field.
- Select edit tags for event type.
The Create/Add Tag dialog box will pop up:
Image:Tagevents-tagevents1.jpg
- Enter your tags and click save.
Once you have tagged an event type, you can search for it in the search bar with the eventtypetag preface.
eventtypetag=foo