Knowledge Management

How to troubleshoot tagging process?

shai
Explorer

I developed my first app and am trying to integrate it into CIM using the documentations.
so far I Successfuly defined an eventtype in eventtype.conf

[my_event_type]
search = sourcetype=my_source

and when I search for this event type I get all the results:
eventtype=my_event_type

Now I continue to define tags, using this guide

My tags.conf file looks like this:
[eventtype=my_event_type]
alert = enabled

But nothing is returned when I search for:
tag=alert

Moreover when I search for all types of tags I get only one type "error" and it's count is significantly less then the eventtype amount:
sourcetype=my_source | stats count by tag

In the guide it says "Once you have tagged an event type, you can search for it in the search bar" but I can't search for the tags.

How can I troubleshoot the process?
What should I look for?
What am I missing?

thank you.

Labels (3)
0 Karma

shai
Explorer

solved the issue. it had to do with permissions. tag should have global permissions for search app to recognize it

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...