Knowledge Management
Highlighted

Help searching using eventtype and tags

Communicator

I'm trying to tag specific data to a category name and only return data that matches the tag. For example,

index = bcoatlogs eventtype=myTest_category | search tag=proxy | stats count by tag

I created an eventtype for "myTestcategory" and applied only the tag "proxy" to this but I am showing results for proxy, web, os, mail, usb, etc. Is it possible to use this method or do tag simply get ignored in SPL? Open to other suggestions as well

Thank you

0 Karma
Highlighted

Re: Help searching using eventtype and tags

Builder

proxy in double quotes not helping?

| search tag="proxy"

0 Karma
Highlighted

Re: Help searching using eventtype and tags

Communicator

I return 5 different tags even though I'm querying a new eventtype I created that only has the tag "proxy" attached to it..

index=* eventtype="WebProxyWeb_Filtering" | search tag="proxy"alt text

0 Karma
Highlighted

Re: Help searching using eventtype and tags

Esteemed Legend

If I understand you correctly, you would like your events to ONLY show those eventtypes that are owned by YOU. If so, just add this to the bottom of your search (be sure to replace the <*****INSERT YOUR SPLUNK LOGIN HERE*****>😞

... | eval eventtype = mvfilter(match(eventtype, [| rest/servicesNS/<*****INSERT YOUR SPLUNK LOGIN HERE*****>/-/configs/conf-eventtypes splunk_server=local 
| table title 
| format "" "" "" "|" "" "" 
| rex field=search mode=sed "s/title=//g s/\"//g s/ //g s/^/\"/ s/\|?$/\"/"
| return $search]))
| table eventtype
0 Karma