All Apps and Add-ons

how to tag a field from sourcetype in Missile Map?

masy
New Member

how to tag a field from sourcetype in Missile Map ?

Tags (1)
0 Karma

koshyk
Super Champion

You need to do in two files (eventtypes.conf & tags.conf) . In your own app (or the local directory of the Missile Map app) create those two files

=> In eventtypes.conf, group all the events which are same

[my_special_missile_eventtype]
search = sourcetype="whatever_your_missle_map_sourcetype" someField=someKey

=> In tags.conf, put the eventtypes and tag all of them

[eventtype=my_special_missile_eventtype]
authentication = enabled
user = enabled
mycustomTag=someTag
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!