https://community.splunk.com/t5/Splunk-Search/What-is-the-purpose-of-double-colon-syntax-in-alerts/m-p/591333#M205859 <P>Read about tags</P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.2.5/Knowledge/TagandaliasfieldvaluesinSplunkWeb" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.5/Knowledge/TagandaliasfieldvaluesinSplunkWeb</A></P> Tue, 29 Mar 2022 19:18:34 GMT PickleRick 2022-03-29T19:18:34Z https://community.splunk.com/t5/Splunk-Search/What-is-the-purpose-of-double-colon-syntax-in-alerts/m-p/591329#M205858 <P>We're doing a review of several thousand alerts. About half of them have this syntax at the end of the initial search terms, where "MyAlertName" is literally the alert name:</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="cpp">NOT tag::host=MyAlertName</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>What does it mean? It doesn't seem to make any difference if it's there or not, but the searches do work with it present, apparently it is syntactically correct.</P> <P>The docs I've found relating to double-colon syntax don't seem to describe anything like this, and "host" in our environment is always a server name.</P> Tue, 29 Mar 2022 20:16:02 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-purpose-of-double-colon-syntax-in-alerts/m-p/591329#M205858 mv10 2022-03-29T20:16:02Z https://community.splunk.com/t5/Splunk-Search/What-is-the-purpose-of-double-colon-syntax-in-alerts/m-p/591333#M205859 <P>Read about tags</P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.2.5/Knowledge/TagandaliasfieldvaluesinSplunkWeb" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.5/Knowledge/TagandaliasfieldvaluesinSplunkWeb</A></P> Tue, 29 Mar 2022 19:18:34 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-purpose-of-double-colon-syntax-in-alerts/m-p/591333#M205859 PickleRick 2022-03-29T19:18:34Z https://community.splunk.com/t5/Splunk-Search/What-is-the-purpose-of-double-colon-syntax-in-alerts/m-p/591346#M205863 <P>Thanks!</P> Tue, 29 Mar 2022 19:57:08 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-purpose-of-double-colon-syntax-in-alerts/m-p/591346#M205863 mv10 2022-03-29T19:57:08Z