Getting Data In

Unable to see tags on REST API output

markov00
New Member

I've indexed some web server logs and than I've assigned a tag to the status field, so I can receive the tag name instead of the http status code. It' works correctly on splunk web: I can see for each log it's tag. But when I use the REST API I can't see the tags I associated to the status. Either I can't see the status as a field in the response.
How can I setup my Splunk to output these values?
Thanks
Marco

Tags (3)
0 Karma

chimbudp
Contributor

Hello ,

troubleshoot like,
Make sure that you copied the TAG.CONF file to the application that you are using. (you might be using in SEARCH , not in other app)
Once you create a TAG , you need to REFRESH your SEARCH for the tag to happen.
You can make sure the permissions of the TAG that you create under MANAGER -> TAGS ->List by field value pair

I think this will not create much trouble in tags concept

0 Karma

markov00
New Member

I'm using directly splunk web for configure everything, each tag is set to be used by all the application. As I've written on my first post I can see the tag after I've created them on splunk web, but if I start a the savedSearch from the REST API I don't receive the tag field.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...