Knowledge Management

How to troubleshoot tagging process?

shai
Explorer

I developed my first app and am trying to integrate it into CIM using the documentations.
so far I Successfuly defined an eventtype in eventtype.conf

[my_event_type]
search = sourcetype=my_source

and when I search for this event type I get all the results:
eventtype=my_event_type

Now I continue to define tags, using this guide

My tags.conf file looks like this:
[eventtype=my_event_type]
alert = enabled

But nothing is returned when I search for:
tag=alert

Moreover when I search for all types of tags I get only one type "error" and it's count is significantly less then the eventtype amount:
sourcetype=my_source | stats count by tag

In the guide it says "Once you have tagged an event type, you can search for it in the search bar" but I can't search for the tags.

How can I troubleshoot the process?
What should I look for?
What am I missing?

thank you.

Labels (3)
0 Karma

shai
Explorer

solved the issue. it had to do with permissions. tag should have global permissions for search app to recognize it

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...