<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Too complex for tags? in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Too-complex-for-tags/m-p/238877#M2089</link>
    <description>&lt;P&gt;I want to create a tag that involves two extracted fields and a combination of AND/OR statements, see example below.&lt;/P&gt;

&lt;P&gt;key/value pair 1&lt;BR /&gt;
(PolicySetName=policy1 AND (AuthPolicy=auth1 OR AuthPolicy=auth2 OR AuthPolicy=auth3))&lt;/P&gt;

&lt;P&gt;key/value pair 2&lt;BR /&gt;
(PolicySetName=policy2 AND AuthPolicy=auth4)&lt;/P&gt;

&lt;P&gt;key/value pair 3&lt;BR /&gt;
(PolicySetName=policy3 AND AuthPolicy=auth5)&lt;/P&gt;

&lt;P&gt;Is this even possible with a tag?&lt;/P&gt;</description>
    <pubDate>Wed, 17 Aug 2016 13:23:49 GMT</pubDate>
    <dc:creator>jedatt01</dc:creator>
    <dc:date>2016-08-17T13:23:49Z</dc:date>
    <item>
      <title>Too complex for tags?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Too-complex-for-tags/m-p/238877#M2089</link>
      <description>&lt;P&gt;I want to create a tag that involves two extracted fields and a combination of AND/OR statements, see example below.&lt;/P&gt;

&lt;P&gt;key/value pair 1&lt;BR /&gt;
(PolicySetName=policy1 AND (AuthPolicy=auth1 OR AuthPolicy=auth2 OR AuthPolicy=auth3))&lt;/P&gt;

&lt;P&gt;key/value pair 2&lt;BR /&gt;
(PolicySetName=policy2 AND AuthPolicy=auth4)&lt;/P&gt;

&lt;P&gt;key/value pair 3&lt;BR /&gt;
(PolicySetName=policy3 AND AuthPolicy=auth5)&lt;/P&gt;

&lt;P&gt;Is this even possible with a tag?&lt;/P&gt;</description>
      <pubDate>Wed, 17 Aug 2016 13:23:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Too-complex-for-tags/m-p/238877#M2089</guid>
      <dc:creator>jedatt01</dc:creator>
      <dc:date>2016-08-17T13:23:49Z</dc:date>
    </item>
    <item>
      <title>Re: Too complex for tags?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Too-complex-for-tags/m-p/238878#M2090</link>
      <description>&lt;P&gt;Set your tags starting from eventtypes creation, assigning a tag to an eventtype as you want complex, don't start from creating a new tags, you'll reach your target.&lt;BR /&gt;
Bye.&lt;BR /&gt;
Giuseppe&lt;/P&gt;</description>
      <pubDate>Wed, 17 Aug 2016 16:04:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Too-complex-for-tags/m-p/238878#M2090</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2016-08-17T16:04:47Z</dc:date>
    </item>
    <item>
      <title>Re: Too complex for tags?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Too-complex-for-tags/m-p/238879#M2091</link>
      <description>&lt;P&gt;if you're satisfied of the answer, please, accept the answer.&lt;BR /&gt;
Bye.&lt;BR /&gt;
Giuseppe&lt;/P&gt;</description>
      <pubDate>Fri, 09 Sep 2016 11:07:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Too-complex-for-tags/m-p/238879#M2091</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2016-09-09T11:07:48Z</dc:date>
    </item>
  </channel>
</rss>

