topic Re: Unable to see tags on REST API output in Getting Data In

Unable to see tags on REST API output

markov00 — Thu, 04 Jul 2013 08:44:08 GMT

I've indexed some web server logs and than I've assigned a tag to the status field, so I can receive the tag name instead of the http status code. It' works correctly on splunk web: I can see for each log it's tag. But when I use the REST API I can't see the tags I associated to the status. Either I can't see the status as a field in the response.
How can I setup my Splunk to output these values?
Thanks
Marco

Re: Unable to see tags on REST API output

chimbudp — Thu, 04 Jul 2013 10:44:17 GMT

Hello ,

troubleshoot like,
Make sure that you copied the TAG.CONF file to the application that you are using. (you might be using in SEARCH , not in other app)
Once you create a TAG , you need to REFRESH your SEARCH for the tag to happen.
You can make sure the permissions of the TAG that you create under MANAGER -> TAGS ->List by field value pair

I think this will not create much trouble in tags concept

Re: Unable to see tags on REST API output

markov00 — Fri, 05 Jul 2013 10:16:01 GMT

I'm using directly splunk web for configure everything, each tag is set to be used by all the application. As I've written on my first post I can see the tag after I've created them on splunk web, but if I start a the savedSearch from the REST API I don't receive the tag field.