<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How create a tag based on field name ? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-create-a-tag-based-on-field-name/m-p/646153#M109924</link>
    <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/257534"&gt;@TanyaCnd&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;why don't you try to use two different tags?&lt;/P&gt;&lt;P&gt;e.g:&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;USER or ADMIN for the first one&lt;/LI&gt;&lt;LI&gt;FIELD1 FIELD2 FIELD3, etc... for the second one&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;then you can use them for your searches:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;tag=ADMIN tag=FIELD1&lt;/LI-CODE&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
    <pubDate>Wed, 07 Jun 2023 15:13:46 GMT</pubDate>
    <dc:creator>gcusello</dc:creator>
    <dc:date>2023-06-07T15:13:46Z</dc:date>
    <item>
      <title>How create a tag based on field name ?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-create-a-tag-based-on-field-name/m-p/646150#M109923</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;I am trying create tags based on index and field name .&amp;nbsp; Log:&lt;BR /&gt;1, User.field1,&amp;nbsp;User.field2,&amp;nbsp;User.field3&lt;/P&gt;&lt;P&gt;2, Admin.field1,&amp;nbsp;Admin.field2,&amp;nbsp;Admin.field3&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;3, Admin.field1,&amp;nbsp;Admin.field2,&amp;nbsp;Admin.field3&lt;/P&gt;&lt;P&gt;I want tag User.* fields with tag User and Admin.* with Admin. So, when we search with tag User only User events listed&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks&lt;/P&gt;</description>
      <pubDate>Wed, 07 Jun 2023 15:03:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-create-a-tag-based-on-field-name/m-p/646150#M109923</guid>
      <dc:creator>TanyaCnd</dc:creator>
      <dc:date>2023-06-07T15:03:08Z</dc:date>
    </item>
    <item>
      <title>Re: How create a tag based on field name ?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-create-a-tag-based-on-field-name/m-p/646153#M109924</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/257534"&gt;@TanyaCnd&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;why don't you try to use two different tags?&lt;/P&gt;&lt;P&gt;e.g:&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;USER or ADMIN for the first one&lt;/LI&gt;&lt;LI&gt;FIELD1 FIELD2 FIELD3, etc... for the second one&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;then you can use them for your searches:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;tag=ADMIN tag=FIELD1&lt;/LI-CODE&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
      <pubDate>Wed, 07 Jun 2023 15:13:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-create-a-tag-based-on-field-name/m-p/646153#M109924</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2023-06-07T15:13:46Z</dc:date>
    </item>
  </channel>
</rss>

