Knowledge Management

Help searching using eventtype and tags


I'm trying to tag specific data to a category name and only return data that matches the tag. For example,

index = bcoat_logs eventtype=my_Test_category | search tag=proxy | stats count by tag

I created an eventtype for "my_Test_category" and applied only the tag "proxy" to this but I am showing results for proxy, web, os, mail, usb, etc. Is it possible to use this method or do tag simply get ignored in SPL? Open to other suggestions as well

Thank you

0 Karma

Esteemed Legend

If I understand you correctly, you would like your events to ONLY show those eventtypes that are owned by YOU. If so, just add this to the bottom of your search (be sure to replace the <*****INSERT YOUR SPLUNK LOGIN HERE*****>😞

... | eval eventtype = mvfilter(match(eventtype, [| rest/servicesNS/<*****INSERT YOUR SPLUNK LOGIN HERE*****>/-/configs/conf-eventtypes splunk_server=local 
| table title 
| format "" "" "" "|" "" "" 
| rex field=search mode=sed "s/title=//g s/\"//g s/ //g s/^/\"/ s/\|?$/\"/"
| return $search]))
| table eventtype
0 Karma


I return 5 different tags even though I'm querying a new eventtype I created that only has the tag "proxy" attached to it..

index=* eventtype="Web_Proxy_Web_Filtering" | search tag="proxy"alt text

0 Karma


proxy in double quotes not helping?

| search tag="proxy"

0 Karma