I've indexed some web server logs and than I've assigned a tag to the status field, so I can receive the tag name instead of the http status code. It' works correctly on splunk web: I can see for each log it's tag. But when I use the REST API I can't see the tags I associated to the status. Either I can't see the status as a field in the response.
How can I setup my Splunk to output these values?
Make sure that you copied the TAG.CONF file to the application that you are using. (you might be using in SEARCH , not in other app)
Once you create a TAG , you need to REFRESH your SEARCH for the tag to happen.
You can make sure the permissions of the TAG that you create under MANAGER -> TAGS ->List by field value pair
I think this will not create much trouble in tags concept
I'm using directly splunk web for configure everything, each tag is set to be used by all the application. As I've written on my first post I can see the tag after I've created them on splunk web, but if I start a the savedSearch from the REST API I don't receive the tag field.