topic Re: Tagging Data in Knowledge Management

Tagging Data

JoshuaJJ — Wed, 05 Jun 2024 14:09:42 GMT

Good morning,

I recently created a tag for a set of hosts. For example, CA for all California hosts. Does this take time to populate or show up within my Data Models? I am running a search similar to this

| tstats count FROM datamodel=<data_model>.<root_event> WHERE tag=CA BY _time, host, etc....

I have also tried this

| datamodel <data_model> <root_event> search

| search tag=CA

| table _time, host, etc....

Re: Tagging Data

gcusello — Wed, 05 Jun 2024 14:28:45 GMT

Hi @JoshuaJJ ,

two topics:

is tag a field of your DataModel?

You can check this in your DataModel definition.

if not, you cannot use it or you have to modify your DataModel fields.

if yes, you have to use the <your_datamodel> prefix befor tag in the WHERE condition:

| tstats count FROM datamodel=<data_model>.<root_event> WHERE <data_model>.tag=CA BY _time host

Ciao.

Giuseppe

Re: Tagging Data

JoshuaJJ — Wed, 05 Jun 2024 14:42:55 GMT

Thank you so much for the help. I always forget to add fields to the Data Model 🙂

Re: Tagging Data

gcusello — Wed, 05 Jun 2024 14:44:02 GMT

Hi @JoshuaJJ ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉