Tag event types
This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
Contents
Tag event types
Event types can be tagged to add information to your data. Any event type can have multiple tags. For example, you can tag all firewall events as firewall, tag a subset as deny and tag another subset as allow. Once an event type is tagged, any event type matching the tagged pattern will also be tagged.
Note: An event type must be configured via eventtypes.conf or saved in order to be tagged.
Configuration
Tag an event type from within Splunk Web. Note: Make sure you have enabled the eventtype field from the fields drop down menu.
- Click on the drop-down arrow next to the eventtype field.
- Select Tag event type.
- The Create/Add Tag dialog box pops up.
- Enter your tags and click save.
Once you have tagged an event type, you can search for it in the search bar with the eventtypetag preface.
eventtypetag=foo