Getting Data In

Unable to see tags on REST API output

markov00
New Member

I've indexed some web server logs and than I've assigned a tag to the status field, so I can receive the tag name instead of the http status code. It' works correctly on splunk web: I can see for each log it's tag. But when I use the REST API I can't see the tags I associated to the status. Either I can't see the status as a field in the response.
How can I setup my Splunk to output these values?
Thanks
Marco

Tags (3)
0 Karma

chimbudp
Contributor

Hello ,

troubleshoot like,
Make sure that you copied the TAG.CONF file to the application that you are using. (you might be using in SEARCH , not in other app)
Once you create a TAG , you need to REFRESH your SEARCH for the tag to happen.
You can make sure the permissions of the TAG that you create under MANAGER -> TAGS ->List by field value pair

I think this will not create much trouble in tags concept

0 Karma

markov00
New Member

I'm using directly splunk web for configure everything, each tag is set to be used by all the application. As I've written on my first post I can see the tag after I've created them on splunk web, but if I start a the savedSearch from the REST API I don't receive the tag field.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...