https://community.splunk.com/t5/Knowledge-Management/How-to-tag-a-field-sourcetype-from-the-search-bar/m-p/180294#M1651 <P>Search for a value you want to tag, expand an event with that field value, look for the field you want to add a tag to, click the down-triangle to the right in the Actions column and select Edit Tags. That'll let you enter a tag for this field value.</P> <P>After tagging you can then search by using <CODE>tag=value</CODE> or <CODE>tag::fieldname=value</CODE>.<BR /> You can edit and add more tags through the Settings as well by going into the Tags section.</P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Abouttagsandaliases">http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Abouttagsandaliases</A> for documentation on tagging your data.</P> Wed, 13 Aug 2014 11:36:55 GMT martin_mueller 2014-08-13T11:36:55Z https://community.splunk.com/t5/Knowledge-Management/How-to-tag-a-field-sourcetype-from-the-search-bar/m-p/180293#M1650 <P>I tried to tag the field sourcetype as suggested in the link :</P> <P>[<A href="http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Tags%5D%5B1">http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Tags][1</A>]</P> <PRE><CODE>Examples Example 1: Write tags for host and eventtype fields into tag::host and tag::eventtype. ... | tags host eventtype </CODE></PRE> <HR /> <P>index=* | tags sourcetype</P> <P>but it doesnt created tag::sourcetype</P> <P>Please help.. Am i missing something ..?</P> Wed, 13 Aug 2014 11:26:28 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-tag-a-field-sourcetype-from-the-search-bar/m-p/180293#M1650 splunker12er 2014-08-13T11:26:28Z https://community.splunk.com/t5/Knowledge-Management/How-to-tag-a-field-sourcetype-from-the-search-bar/m-p/180294#M1651 <P>Search for a value you want to tag, expand an event with that field value, look for the field you want to add a tag to, click the down-triangle to the right in the Actions column and select Edit Tags. That'll let you enter a tag for this field value.</P> <P>After tagging you can then search by using <CODE>tag=value</CODE> or <CODE>tag::fieldname=value</CODE>.<BR /> You can edit and add more tags through the Settings as well by going into the Tags section.</P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Abouttagsandaliases">http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Abouttagsandaliases</A> for documentation on tagging your data.</P> Wed, 13 Aug 2014 11:36:55 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-tag-a-field-sourcetype-from-the-search-bar/m-p/180294#M1651 martin_mueller 2014-08-13T11:36:55Z