Documentation:
3.2.3
This page last updated: 09/30/08 02:09pm
About tags
Tags help you group search results that share field values. Attach a name, or tag, to a group of results that share the same value of an indexed field (for example: event type, host, or source), or an extracted field. Apply any number of tags to a any field, event type, host, or source (Learn how to tag fields).
Example:
If you have an extracted field IPaddresses that contains IP addresses of your data sources, you can make it useful by tagging each IP address based on its functionality or location. You can tag all of your routers' IP addresses as router. You can also tag each IP address based on its location, for example: SF or Building1. An IP address of a router located in San Francisco inside Building 1 could have tags router, SF, and Building1.
If you want to search for all routers in San Francisco that are not in building 1, you search for the following:
tag=router tag=SF NOT (tag=Building1)
For another example of using tags to search, you can watch this Splunk developer video.
Source type aliasesSource type aliases are similar to tags except you can only apply a single alias to one (or more) source types and only one alias to a single source type. Read more about Sourcetype aliasing.
Search for events containing tagsSearch for tags by using the tag search modifier. The following examples show how to search for events using the tag modifier.
When you tag a host or source, Splunk adds the tag next to the host or source in the main dashboard. Search using the tags in the main dashboard by clicking on them. Splunk adds hosttag="tagname" in the search bar when you click on a host tag, and tag::source="tagname" when you click on a source tag.
The following examples search for events that have the field date_year tagged with the tag "2007".
tag::field::tag
Example:
tag::date_year::2007Example:
tag::date_year=2007tag=tag
Example:
tag=2007Splunk allows you to configure and share tags easily by storing tag information in the tags.conf configuration file. Learn how to configure tags via tags.conf.
Configure roles for taggingDefine specific capabilities for tagging in your role configuration. A Splunk administrator must define the ability to create, edit, or delete tags in your role configuration by editing authorize.conf.
Comments
No comments have been submitted.