Tag Definition and Field value pair

[kumva01]

Hi All,

I’m looking for an SPL query that can return the list of Tag Names along with their associated field-value pair definitions (similar to what we usually see under Settings → Tags → List by Tag Name in Splunk). I tried exploring a few REST commands, but none of them showed the field-value pair definitions. Is it possible to retrieve these details

Regards,

VK

[livehybrid]

Hey @kumva01 

How about this?

|rest /services/saved/eventtypes | eval title="eventtype=".title | mvexpand tags | stats values(title) as pairs by tags | where tags!=""

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PickleRick]

search/tags

I suppose eventtype-assigned tags might also be available via

saved/eventtypes