Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Re: Categorizing tags
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have tags for the name of cameras and then tags for the status of the cameras that I created through eventtypes. Both of these tags are under the same tag category in my data and I want to create a panel that shows only the status tags. When I do |status count by tag it includes the name tags. Is it possible to categorize tags that are created through event types so that I could do something along the lines of |stats count by tag_status?
I have very little experience with splunk so any help would be fantastic!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just drop or keep the tags you like with | regex tag="YourRegExHere" at the end. What is interesting about multi-valued fields (like tags) is that a single event will be counted in each value (each tag) so your counts for the tags that you'd like to keep should be correct. Just drop the stuff you don't need.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just drop or keep the tags you like with | regex tag="YourRegExHere" at the end. What is interesting about multi-valued fields (like tags) is that a single event will be counted in each value (each tag) so your counts for the tags that you'd like to keep should be correct. Just drop the stuff you don't need.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I just tried using the regex with two tags as |regex tag="Working" OR tag="No_Images" and it does not like it. I have four specific tags that I want to count. What would that code look like? Will regex work with stats count?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
|regex tag="Working|No_Images|Tag3|Tag4"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That helps! So now what do I write for the stats count function? Because if I do |stats count by tag it does it for all the tags I have instead of the four that I want.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I look at the events with '|regex tag="Working|No_Images|Tag3|Tag4"' it is only showing 167 when I have over 400,000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just kidding I had extra stuff in my search! But I am still having trouble with the count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yay I got it!! I needed to do the regex after the count! Thank y'all so so so much!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's what I said in the first place ("at the end")! 😆 I am glad that you got it.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Event Series May & June: From Network Visibility to Service Intelligence
Global Splunk User Group Events: May + June 2026
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
