https://community.splunk.com/t5/Getting-Data-In/Can-I-remove-a-tag-from-already-indexed-data/m-p/347058#M63746 <P>Tags are evaluated at search time and are not stored with indexed data so disabling tags would be sufficient.</P> Tue, 31 Oct 2017 18:18:37 GMT somesoni2 2017-10-31T18:18:37Z https://community.splunk.com/t5/Getting-Data-In/Can-I-remove-a-tag-from-already-indexed-data/m-p/347057#M63745 <P>Is it possible to remove a tag from indexed data? Fox example if I have an app named 'TA-App' and it had a tag for #dhcp, #dns and #email, would I be able to remove the #email tag using the gui by disabling that tag? Or do I need to disable it then delete the index data to remove the tag?</P> Tue, 31 Oct 2017 17:50:20 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-remove-a-tag-from-already-indexed-data/m-p/347057#M63745 mrtolu6 2017-10-31T17:50:20Z https://community.splunk.com/t5/Getting-Data-In/Can-I-remove-a-tag-from-already-indexed-data/m-p/347058#M63746 <P>Tags are evaluated at search time and are not stored with indexed data so disabling tags would be sufficient.</P> Tue, 31 Oct 2017 18:18:37 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-remove-a-tag-from-already-indexed-data/m-p/347058#M63746 somesoni2 2017-10-31T18:18:37Z