topic Re: help on tag in Splunk Enterprise

help on tag

jip31 — Fri, 16 Feb 2024 06:19:00 GMT

I have created a tag for the field "counter" called "a"

But when I run a search with tag=a or with tag::counter="a", there is no results

what is the problem please?

Re: help on tag

gcusello — Fri, 16 Feb 2024 08:06:21 GMT

Hi @jip31,

let me understand:

you created an eventtype like the following

counter="a"

and you associated to this eventtype a tag called "a" then, when you run a search where this field is present, you don't see the value "a" in the tag field, or the search tag="a" hasn't any result, is it correct?

did you check if in the results of the search that you're analyzing the counter field is present?

then, are you sure about the exact value of tag? tag field is case sensitive.

Ciao.

Giuseppe

Re: help on tag

jip31 — Fri, 16 Feb 2024 08:30:16 GMT

I can see the tag

But when I am doing tag="a", i have no results

Re: help on tag

gcusello — Fri, 16 Feb 2024 08:40:24 GMT

Hi @jip31,

which search did you run:

tag="a"

index=your_index tag="a"

if you didn't inserted the index in the eventtype, you don't have it in the tag search and probably your index isn't in the default search path.

Try to add the index in the eventtype (also index=* if you don't want to associate the tag to a specific index) and try again.

Ciao.

Giuseppe

Re: help on tag

jip31 — Fri, 16 Feb 2024 08:46:13 GMT

index=mem tag=a return results but not tag=a

you are right, when I add the tage add the index level tag=a works

Re: help on tag

gcusello — Fri, 16 Feb 2024 08:48:05 GMT

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉