How can we check if tag exists?

[danielbb]

We are trying the following -

index=<index name>
| head 4000 
| eval containstag = if(tag="*", "true", "false") 
| stats 
    count(eval(containstag="true")) as totaltags,
    count(_raw) as totalevents
    by index

Nothing comes back and removing the double quotes - if(tag=*, "true", "false") throws a syntax error.

What can we do?

[to4kawa]

index=<index name> | head 4000
 | eval containstag = if(isnull(tag), "false", "true")
 | stats count(eval(containstag="true")) as totaltags, count as totalevents by index

[richgalloway]

"*" is not a valid tag name and is not treated as a wildcard by if. Try this query:

... | eval containstag = if(match(tag, ".*"), 1, 0)
| stats sum(containstag) as totaltags, count as totalevents by index

[danielbb]

And -

 index=<index name> | head 4000
| eval containstag = if(tag::eventtype="*", "true", "false")
| stats 
  count(eval(containstag="true")) as totaltags,
  count(_raw) as totalevents
  by index 

Here, we get a syntax error on if(tag::eventtype="*", "true", "false").