How can I see all tags in ES?

[danielbb]

Going one by one through the tags and I can see the indexes which are tagged. So, we found the related indexes of authentication by running tag=authentication NOT (action=success user=*$).

So I wonder how can I find all the ES related tags? as tag=* gives no results...

[woodcock]

First of all, ES does not "use tags", it uses the CIM which does "use tags".
As far as investigating the CIM's use of tags and the data that you have in Splunk, the best tool that you can use is CIM Validator here:
https://github.com/hire-vladimir/SA-cim_vladiator

[jawaharas · Accepted solution]

Direct answer to this question is not a low-hanging fruit.

The list of datamodels used in ESS can be referred here - http://dev.splunk.com/view/enterprise-security/SP-CAAAFBM

And the 'tag' details corresponding to the each datamodel can be referred here (click on each datamodel to see tag details) - https://docs.splunk.com/Documentation/CIM/latest/User/Overview

[danielbb]

Nice, tag=authentication shows me the data but tag=web doesn't, even though we have web data.

index=* tag=web does work. So, why do we need in some case the index=* part? and in others it's not needed.

[jawaharas]

Can you accept the answer if it's helpful?

[danielbb]

Ok, the admin user doesn't have all the indexes in the default set of indexes ...

[jawaharas]

You are right. For performance reasons it's not wiser to set 'Indexes searched by default' to search all indexes.