https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80036#M2658 <P>I created a tag with a field value pair of host=server1* called test. Everything works great until I try to change the permissions on it so my colleagues can use it. I set the permission from Private to App where everyone can read it and only admin can write. When I save this change, the Tag name disappears, but the field value pair remains.<BR /> When I click the field value pair to edit the tags associated with it, I re-add the test tag, save, but the Tag Name area is still blank. What gives?</P> Mon, 07 Jan 2013 19:17:20 GMT mmclain1 2013-01-07T19:17:20Z https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80036#M2658 <P>I created a tag with a field value pair of host=server1* called test. Everything works great until I try to change the permissions on it so my colleagues can use it. I set the permission from Private to App where everyone can read it and only admin can write. When I save this change, the Tag name disappears, but the field value pair remains.<BR /> When I click the field value pair to edit the tags associated with it, I re-add the test tag, save, but the Tag Name area is still blank. What gives?</P> Mon, 07 Jan 2013 19:17:20 GMT https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80036#M2658 mmclain1 2013-01-07T19:17:20Z https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80037#M2659 <P>What are you seeing in tags.conf? Look in both the etc/apps/<APP>/local folder and etc/users/<YOU>/<APP>/local.</APP></YOU></APP></P> Mon, 07 Jan 2013 19:29:28 GMT https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80037#M2659 emiller42 2013-01-07T19:29:28Z https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80038#M2660 <P>/opt/splunk/etc/apps/search/local/tags.conf:<BR /> [host=server1%2A]<BR /> test = enabled</P> <P>Nothing in the other file.</P> <P>Also, when I go to "List by tag name", there are no tags listed...</P> Mon, 07 Jan 2013 19:40:51 GMT https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80038#M2660 mmclain1 2013-01-07T19:40:51Z https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80039#M2661 <P>Were you trying to use a wildcard in the tag? (%2A = *) </P> <PRE><CODE>[host=server1*] test = enabled </CODE></PRE> <P>That's not something you can do in tags. Each host=value pair must be explicitly defined. So if you have server10, server11, server12, then you need three separate tags defined.</P> <PRE><CODE>[host=server10] test = enabled [host=server11] test = enabled [host=server12] test = enabled </CODE></PRE> <P>Yes, this sucks when you have a lot of servers. </P> Mon, 07 Jan 2013 19:50:52 GMT https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80039#M2661 emiller42 2013-01-07T19:50:52Z https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80040#M2662 <P>Ah, that explains it. Thanks!</P> Mon, 07 Jan 2013 19:58:01 GMT https://community.splunk.com/t5/Security/Tags-Disappear-When-Changing-Permissions/m-p/80040#M2662 mmclain1 2013-01-07T19:58:01Z