How to troubleshoot tagging process?

shai — Wed, 20 Sep 2023 14:57:31 GMT

I developed my first app and am trying to integrate it into CIM using the documentations.
so far I Successfuly defined an eventtype in eventtype.conf

[my_event_type]
search = sourcetype=my_source

and when I search for this event type I get all the results:
eventtype=my_event_type

Now I continue to define tags, using this guide

My tags.conf file looks like this:
[eventtype=my_event_type]
alert = enabled

But nothing is returned when I search for:
tag=alert

Moreover when I search for all types of tags I get only one type "error" and it's count is significantly less then the eventtype amount:
sourcetype=my_source | stats count by tag

In the guide it says "Once you have tagged an event type, you can search for it in the search bar" but I can't search for the tags.

How can I troubleshoot the process?
What should I look for?
What am I missing?

thank you.

Re: How to troubleshoot tagging process?

shai — Thu, 21 Sep 2023 22:19:50 GMT

solved the issue. it had to do with permissions. tag should have global permissions for search app to recognize it

topic Re: How to troubleshoot tagging process? in Knowledge Management

How to troubleshoot tagging process?

Re: How to troubleshoot tagging process?