https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185203#M53379 <P>We've tagged our hosts which we can search for by 'tag::host', but how do we reference that field from an eval command? Do we first need to rename it or is there a direct way?</P> Mon, 18 Aug 2014 09:47:09 GMT gilescope 2014-08-18T09:47:09Z https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185203#M53379 <P>We've tagged our hosts which we can search for by 'tag::host', but how do we reference that field from an eval command? Do we first need to rename it or is there a direct way?</P> Mon, 18 Aug 2014 09:47:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185203#M53379 gilescope 2014-08-18T09:47:09Z https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185204#M53380 <P>Hi gilescope,</P> <P>this is possible. I used a tag called <CODE>foo-box</CODE> for a special host and if you search like this </P> <PRE><CODE>your base search here | where 'tag::host'="foo-box" </CODE></PRE> <P>you can use it without any problem.</P> <P>cheers, MuS</P> Mon, 18 Aug 2014 10:29:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185204#M53380 MuS 2014-08-18T10:29:31Z https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185205#M53381 <P>Yes this works for search, but I want to include the tag::host field in an eval expression.</P> Mon, 18 Aug 2014 10:40:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185205#M53381 gilescope 2014-08-18T10:40:55Z https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185206#M53382 <P>well <CODE>where</CODE> is an eval command .... can you provide an example of yours which does not work?</P> Mon, 18 Aug 2014 12:26:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185206#M53382 MuS 2014-08-18T12:26:30Z https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185207#M53383 <P>ah yes. single quotes is perfect. I tried double quotes but that turns out as a string constant.</P> Mon, 18 Aug 2014 14:14:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reference-a-tagged-field-from-an-eval-command/m-p/185207#M53383 gilescope 2014-08-18T14:14:51Z