Knowledge Management

Help searching using eventtype and tags

johnward4
Communicator

I'm trying to tag specific data to a category name and only return data that matches the tag. For example,

index = bcoat_logs eventtype=my_Test_category | search tag=proxy | stats count by tag

I created an eventtype for "my_Test_category" and applied only the tag "proxy" to this but I am showing results for proxy, web, os, mail, usb, etc. Is it possible to use this method or do tag simply get ignored in SPL? Open to other suggestions as well

Thank you

0 Karma

woodcock
Esteemed Legend

If I understand you correctly, you would like your events to ONLY show those eventtypes that are owned by YOU. If so, just add this to the bottom of your search (be sure to replace the <*****INSERT YOUR SPLUNK LOGIN HERE*****>😞

... | eval eventtype = mvfilter(match(eventtype, [| rest/servicesNS/<*****INSERT YOUR SPLUNK LOGIN HERE*****>/-/configs/conf-eventtypes splunk_server=local 
| table title 
| format "" "" "" "|" "" "" 
| rex field=search mode=sed "s/title=//g s/\"//g s/ //g s/^/\"/ s/\|?$/\"/"
| return $search]))
| table eventtype
0 Karma

johnward4
Communicator

I return 5 different tags even though I'm querying a new eventtype I created that only has the tag "proxy" attached to it..

index=* eventtype="Web_Proxy_Web_Filtering" | search tag="proxy"alt text

0 Karma

nareshinsvu
Builder

proxy in double quotes not helping?

| search tag="proxy"

0 Karma