https://community.splunk.com/t5/Getting-Data-In/Field-Values-to-Tags/m-p/523228#M88374 <P>Hi All,</P><P>&nbsp;</P><P>I am in an interesting predicament in the environment I work with where our traditional method of tagging devops hosts via UF (in props/transforms) will no longer suffice as the team is moving to kubernetes and using Splunk Connect to forward to the HEC on our SH.&nbsp;</P><P>A few of our Splunk end-users are questioning our ability to dynamically create tags, which they rely heavily on when creating custom reports and dashboards. Long story short, I am curious if there is the ability to assign a field value (i.e, altci) to a tag when a log is sent to the HEC. I believe there may be the ability to do this on the indexer level as data is being sent through the indexing pipeline but I do not have any experience and I can't find any documentation that states this. I would appreciate any type of guidance on this matter. Thank you!</P><P>Dan</P><P>&nbsp;</P><P>Ideally, it would be something like:</P><P>If log has a field named altci, turn the field value into a tag=altcivalue.</P><P>&nbsp;</P> Tue, 06 Oct 2020 15:45:50 GMT dfurtaw 2020-10-06T15:45:50Z https://community.splunk.com/t5/Getting-Data-In/Field-Values-to-Tags/m-p/523228#M88374 <P>Hi All,</P><P>&nbsp;</P><P>I am in an interesting predicament in the environment I work with where our traditional method of tagging devops hosts via UF (in props/transforms) will no longer suffice as the team is moving to kubernetes and using Splunk Connect to forward to the HEC on our SH.&nbsp;</P><P>A few of our Splunk end-users are questioning our ability to dynamically create tags, which they rely heavily on when creating custom reports and dashboards. Long story short, I am curious if there is the ability to assign a field value (i.e, altci) to a tag when a log is sent to the HEC. I believe there may be the ability to do this on the indexer level as data is being sent through the indexing pipeline but I do not have any experience and I can't find any documentation that states this. I would appreciate any type of guidance on this matter. Thank you!</P><P>Dan</P><P>&nbsp;</P><P>Ideally, it would be something like:</P><P>If log has a field named altci, turn the field value into a tag=altcivalue.</P><P>&nbsp;</P> Tue, 06 Oct 2020 15:45:50 GMT https://community.splunk.com/t5/Getting-Data-In/Field-Values-to-Tags/m-p/523228#M88374 dfurtaw 2020-10-06T15:45:50Z