Knowledge Management

Help searching using eventtype and tags

johnward4
Communicator

I'm trying to tag specific data to a category name and only return data that matches the tag. For example,

index = bcoat_logs eventtype=my_Test_category | search tag=proxy | stats count by tag

I created an eventtype for "my_Test_category" and applied only the tag "proxy" to this but I am showing results for proxy, web, os, mail, usb, etc. Is it possible to use this method or do tag simply get ignored in SPL? Open to other suggestions as well

Thank you

0 Karma

woodcock
Esteemed Legend

If I understand you correctly, you would like your events to ONLY show those eventtypes that are owned by YOU. If so, just add this to the bottom of your search (be sure to replace the <*****INSERT YOUR SPLUNK LOGIN HERE*****>😞

... | eval eventtype = mvfilter(match(eventtype, [| rest/servicesNS/<*****INSERT YOUR SPLUNK LOGIN HERE*****>/-/configs/conf-eventtypes splunk_server=local 
| table title 
| format "" "" "" "|" "" "" 
| rex field=search mode=sed "s/title=//g s/\"//g s/ //g s/^/\"/ s/\|?$/\"/"
| return $search]))
| table eventtype
0 Karma

johnward4
Communicator

I return 5 different tags even though I'm querying a new eventtype I created that only has the tag "proxy" attached to it..

index=* eventtype="Web_Proxy_Web_Filtering" | search tag="proxy"alt text

0 Karma

nareshinsvu
Builder

proxy in double quotes not helping?

| search tag="proxy"

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...