Help searching using eventtype and tags

[johnward4]

I'm trying to tag specific data to a category name and only return data that matches the tag. For example,

index = bcoat_logs eventtype=my_Test_category | search tag=proxy | stats count by tag

I created an eventtype for "my_Test_category" and applied only the tag "proxy" to this but I am showing results for proxy, web, os, mail, usb, etc. Is it possible to use this method or do tag simply get ignored in SPL? Open to other suggestions as well

Thank you

[woodcock]

If I understand you correctly, you would like your events to ONLY show those eventtypes that are owned by YOU. If so, just add this to the bottom of your search (be sure to replace the <*****INSERT YOUR SPLUNK LOGIN HERE*****>😞

... | eval eventtype = mvfilter(match(eventtype, [| rest/servicesNS/<*****INSERT YOUR SPLUNK LOGIN HERE*****>/-/configs/conf-eventtypes splunk_server=local 
| table title 
| format "" "" "" "|" "" "" 
| rex field=search mode=sed "s/title=//g s/\"//g s/ //g s/^/\"/ s/\|?$/\"/"
| return $search]))
| table eventtype

[johnward4]

I return 5 different tags even though I'm querying a new eventtype I created that only has the tag "proxy" attached to it..

index=* eventtype="Web_Proxy_Web_Filtering" | search tag="proxy"

[nareshinsvu]

proxy in double quotes not helping?

| search tag="proxy"