https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53489#M13003 <P>I think i got a little closer with <BR /> |metadata type=hosts | fields host| tags| search tag::host=*| fields - host</P> <P>If that is closer, now i need to figure out how to breakup the multiline, dedupe, and make the drill-down work. I'm hoping there is an easy query i'm missing.</P> Sat, 18 Sep 2010 07:55:36 GMT gfriedmann 2010-09-18T07:55:36Z https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53488#M13002 <P>I have been tagging hosts to aid in searching by environment, service, sub-service</P> <P>I would like to make a dashboard widget that lists all the services for a particular environment. </P> <P>Is there a search query i can use to dynamically list all tags in the system or app? </P> Sat, 18 Sep 2010 07:25:48 GMT https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53488#M13002 gfriedmann 2010-09-18T07:25:48Z https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53489#M13003 <P>I think i got a little closer with <BR /> |metadata type=hosts | fields host| tags| search tag::host=*| fields - host</P> <P>If that is closer, now i need to figure out how to breakup the multiline, dedupe, and make the drill-down work. I'm hoping there is an easy query i'm missing.</P> Sat, 18 Sep 2010 07:55:36 GMT https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53489#M13003 gfriedmann 2010-09-18T07:55:36Z https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53490#M13004 <P>This will do it:</P> <PRE><CODE>| metadata type=hosts | tags | mvexpand tag::host | dedup tag::host | fields tag::host </CODE></PRE> <P>If you need to drill down, you should be able to modify the standard dashboard a bit, just to select the right field name(s).</P> <P>BTW, and maybe this is too late for you to consider, but I would strongly recommend for this purpose that you consider a lookup table (with a lookup on <CODE>host</CODE> returning each of your other fields) rather than tags. In some ways, they are much easier to manage, and you will be able to search by, e.g., <CODE>environment=prod service=webserver</CODE> rather than <CODE>tag::host=env-prod tag::host=serv-webserver</CODE>.</P> Sat, 18 Sep 2010 09:15:11 GMT https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53490#M13004 gkanapathy 2010-09-18T09:15:11Z https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53491#M13005 <P>Are you suggesting the lookup table approach specifically because he's hitting metadata, as opposed to raw results? If searching against actual events, wouldn't there be a (possibly severe) performance penalty?</P> Sat, 18 Sep 2010 10:56:01 GMT https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53491#M13005 southeringtonp 2010-09-18T10:56:01Z https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53492#M13006 <P>It would be no worse and probably better to use lookup tables than tags.</P> Sat, 18 Sep 2010 16:09:52 GMT https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53492#M13006 gkanapathy 2010-09-18T16:09:52Z https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53493#M13007 <P>Thank you. Tags seemed more natural to me and i understand them already. I'll investigate the lookup table. I suspect lookup tables would be cached in RAM for it to be speedy. I can see how exporting "tag" type info from another system would be easier with a lookup table.</P> Mon, 20 Sep 2010 23:04:57 GMT https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/53493#M13007 gfriedmann 2010-09-20T23:04:57Z https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/536943#M151785 <P>none of the above queries seem to work.</P> Sun, 24 Jan 2021 02:44:18 GMT https://community.splunk.com/t5/Splunk-Search/Listing-all-tags-in-the-search-interface/m-p/536943#M151785 dbroggy 2021-01-24T02:44:18Z