topic Re: What are the definitions of Tag and Eventtype and what are the differences between the two? in Knowledge Management

What are the definitions of Tag and Eventtype and what are the differences between the two?

kedjjang — Wed, 27 May 2015 02:36:02 GMT

What is the definition of the [Tag] is?
What is the definition of the [Eventtype] is?
What is the point of difference between the [Tag] and [eventtype] is?

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

woodcock — Wed, 27 May 2015 03:16:44 GMT

An eventtype is a search that runs when you specify eventtype=MyEventType; you can think of it like a "pipeless, parameterless macro" or even like a saved search.

A tag is a not-necessarily-unique "nametag" given to a specific, definitive (wildcardless) Key-value-pairing. It is very much like an eventtype but it has the following differences:

An instance of an eventtype name is defined by a single directive inside a single eventtypes.conf file but an instance of a tag name can be defined in an infinite number of separate tags.conf files.

An eventtype definition can use wildcards and have any number of pre-pipe specifications (conjunctions) but a tag definition always contains a singlekey=value pairing.

There is an extremely high degree of use-case overlap between the 2 constructs. For example, if you would like to identify all lab servers you could create a single eventtype like this:

[LAB_EVENTS]
search = host=LAB* OR host=xyz OR host=PDQ

Then you search like this:

eventtype=LAB_EVENTS

Or you could use several tags like this:

[host=LAB1]
lab=enabled
[host=LAB2]
lab=enabled
[host=LAB3]
lab=enabled
[host=xyz]
lab=enabled
[host=PDQ]
lab=enabled

Then you search like this:

tag="lab"

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

HeinzWaescher — Wed, 27 May 2015 08:32:11 GMT

Is there a big difference regarding the performance between eventypes and tags?

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

woodcock — Mon, 27 Feb 2017 15:03:58 GMT

Check out the Knowledge Object Explorer app. With a small number, there is no difference but the more apps and configurations you add, there can be HUGE performance differences between the two.
https://splunkbase.splunk.com/app/2871/

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

splunkreal — Mon, 12 Feb 2018 15:56:59 GMT

Great explanation woodcock, could you give sample results based on those event types and tags?

Thanks.

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

ddrillic — Mon, 12 Feb 2018 16:05:54 GMT

@realsplunk, please keep in mind that Event types are intended for data classification whereas Tags are for data normalization - so, from design perspective, they are very different.

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

arihant16cse — Thu, 07 Mar 2019 13:51:57 GMT

can you tell me when i will use tags and when used eventtypes

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

woodcock — Fri, 20 Mar 2020 15:47:36 GMT

Use tags when you don't need wildcards. Use eventtypes when you do need wildcards. Always prefertags`.

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

woodcock — Fri, 20 Mar 2020 15:48:37 GMT

Look at how the Common Information Model app uses each:
https://docs.splunk.com/Documentation/CIM/latest/User/Overview

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

woodcock — Fri, 20 Mar 2020 15:49:40 GMT

I disagree. I use tags for classification all the time; for example a host can be either production or development.

Re: What are the definitions of Tag and Eventtype and what are the differences between the two?

anwarmian — Mon, 16 Nov 2020 03:00:34 GMT

Nice examples, Woodcock!!! Eventtype is quite easy to understand but tag with enabled/disabled <field><value> is not always clear to a lot of people.

On, the other hand, the whole eventtype can also be tagged in tags.conf like the following

[eventtype=LAB_EVENTS]
lab = enabled