Getting Data In

How create a tag based on field name ?

TanyaCnd
Loves-to-Learn Lots

Hi,

I am trying create tags based on index and field name .  Log:
1, User.field1, User.field2, User.field3

2, Admin.field1, Admin.field2, Admin.field3

3, Admin.field1, Admin.field2, Admin.field3

I want tag User.* fields with tag User and Admin.* with Admin. So, when we search with tag User only User events listed 

Thanks

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @TanyaCnd,

why don't you try to use two different tags?

e.g:

  • USER or ADMIN for the first one
  • FIELD1 FIELD2 FIELD3, etc... for the second one

then you can use them for your searches:

tag=ADMIN tag=FIELD1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...