This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 , 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13
Use search modifiers to filter searches using tags, or use search modifiers to add the results of a saved search as an argument to a search.
You can tag event types based on shared attributes. Use eventtypetag to filter your search to include events that have the specified event type tag (or tags).
eventtypetag=string
| string | Specify a single tag, or a comma-delimited list of tags. |
You can create tags for the host (value of the host field) of events with tags. Use hosttag to filter your search to include events that have hosts that match the specified host tag (or tags).
hosttag=string
| string | Specify a single tag, or a comma-delimited list of tags. |
Adds the text of the saved search to the arguments of the search command. If the saved search contains more than one command (it contains the pipe character), use the savedsearch command instead of the savedsearch modifier.
savedsearch=name_of_saved_search
| name_of_saved_search | Specify a saved search. |
You can tag events with tags to help you identify them in your terms. Use tag to filter your search to only include events that match the specified tag (or tags).
tag=string
| string | Specify a single tag, or a comma-delimited list of tags. |