https://community.splunk.com/t5/Splunk-Enterprise-Security/multiple-tag-eval/m-p/498281#M8698 <P>I've never seen tags set at search time. Typically, they're tested at search time using <CODE>(tag=prod_alert AND tag=risk_information</CODE>, for example.<BR /> Setting tags usually is done via eventtypes, but not a search time.</P> Tue, 12 May 2020 19:21:39 GMT richgalloway 2020-05-12T19:21:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/multiple-tag-eval/m-p/498280#M8697 <P>Hi I am creating a rule in enterprise security and am trying to use multiple tags. <BR /> | eval tag="prod_alert" and <BR /> | eval tag="risk_information" </P> <P>What happens is every time the search runs the second tag overwrites the first tag. What do I need to do differently to use multiple tags in a rule? </P> Wed, 30 Sep 2020 05:25:56 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/multiple-tag-eval/m-p/498280#M8697 metahaxorus 2020-09-30T05:25:56Z https://community.splunk.com/t5/Splunk-Enterprise-Security/multiple-tag-eval/m-p/498281#M8698 <P>I've never seen tags set at search time. Typically, they're tested at search time using <CODE>(tag=prod_alert AND tag=risk_information</CODE>, for example.<BR /> Setting tags usually is done via eventtypes, but not a search time.</P> Tue, 12 May 2020 19:21:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/multiple-tag-eval/m-p/498281#M8698 richgalloway 2020-05-12T19:21:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/multiple-tag-eval/m-p/498282#M8699 <P>Thank you for your comment it made me realize I was going in the wrong direction. </P> <P>I didn't' need a tag. Instead, I made a search macro and set prod_alert=1 which allows me to search that field. </P> Tue, 12 May 2020 20:07:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/multiple-tag-eval/m-p/498282#M8699 metahaxorus 2020-05-12T20:07:22Z