https://community.splunk.com/t5/Splunk-Search/How-to-tag-different-values-for-the-same-field/m-p/148487#M41523 <P>Set "KV_MODE" to "auto":<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles</A></P> Tue, 19 May 2015 16:29:18 GMT woodcock 2015-05-19T16:29:18Z https://community.splunk.com/t5/Splunk-Search/How-to-tag-different-values-for-the-same-field/m-p/148486#M41522 <P>Hi, </P> <P>I have a search and if within an event, I have two values that I want to tag to the same field, what will be the likely method to use? <BR /> Example:</P> <PRE><CODE>12/17/14 12:23:34 AM Name=abc........Name=qwe </CODE></PRE> <P>thks</P> Mon, 23 Feb 2015 07:23:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-tag-different-values-for-the-same-field/m-p/148486#M41522 newbiesplunk 2015-02-23T07:23:00Z https://community.splunk.com/t5/Splunk-Search/How-to-tag-different-values-for-the-same-field/m-p/148487#M41523 <P>Set "KV_MODE" to "auto":<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles</A></P> Tue, 19 May 2015 16:29:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-tag-different-values-for-the-same-field/m-p/148487#M41523 woodcock 2015-05-19T16:29:18Z