Tag hosts
This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4
Contents
Tag hosts
Tagging hosts is useful for knowledge capture and sharing, and for crafting more precise searches. Hosts can be tagged with one or more words describing their function or type, enabling users to easily search for all activity on a group of similar servers.
via SplunkWeb
You can use the drop down arrow next to the host field in SplunkWeb to tag your hosts. Choose Edit tags for this host.
Then, enter your tags, separated by commas:
Host tags vs host names
Host name is extracted at indexing time. Host tags can be added to any host for additional information during searches. Each event can have only one host name, but multiple host tags.
For example, if your Splunk server is receiving compliance data from a specific host, tagging that host with compliance will help your compliance searches. With host tags, you can create a loose grouping of data without masking the underlying host name.