topic tag=usb in Knowledge Management

tag=usb

hendriks — Fri, 26 Feb 2021 16:45:29 GMT

So when searching tag=usb, I get an message telling me : "The term 'usb*:' contains a wildcard in the middle of a word or string. This might cause inconsistent results if the characters that the wildcard represents include punctuation", but i did not add the wildard there myself.

So anyone has any idea where this comes from. One of the things I could think of this comes from an add-on, somewhere..

While investigating this a little bit more I also see funky errors when searching tag=* for instance.

Re: tag=usb

gcusello — Fri, 26 Feb 2021 16:53:05 GMT

Hi @hendriks,

Check in [Settings -- Tag] if there's a tag with "*" inside.

Ciao.

Giuseppe

Re: tag=usb

hendriks — Mon, 01 Mar 2021 13:02:25 GMT

Ah, thank you, no tags with "*" or any other wildcard inside.

I see there is eventtype=nix_usb that has 3 tags, os, unix, usb, this eventtype comes from Splunk_TA_nix.

So no luck there.

When I search for tag=* I also get the message that tag=usb* has a wildcard.

Re: tag=usb

gcusello — Mon, 01 Mar 2021 13:12:00 GMT

Hi @hendriks,

see in File System in $SPLUNK_HOME/etc/apps/Splunk_TA_nix/default/tags.conf and $SPLUNK_HOME/etc/apps/Splunk_TA_nix/local/tags.conf: sometimes there's an error, you ahould also find the same error in Splunk start-up from console.

if you don't find it, try using the btool command:

$SPLUNK_HOME/bin/splunk cmd btool tag list --debug

Ciao.

Giuseppe