We would love it if there was a REST endpoint or way to create and update tags similar to the way we refreshed fields in the old days with "... | extract reload=t".
I understand you can simply restart Splunk to refresh new configuration including tags.conf, but we are trying to find ways to reload dynamically without restarting.
I also understand we have endpoints to support the addition/deletion of tags individually.
Knowledge: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTknowledge#search.2Ftags
Configurations: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTconfig
This is going to require some scripting or coding, which isn't terrible, but if there's a more efficient way to do this it would be preferred. Since there's no 'update' endpoint which means we also have to account for existing tags of the same when adding/deleting. Hoping there's some undocumented endpoint or utility to perform a bulk dynamic refresh.
We like the way tags are displayed next to the field in Splunk Web so using a lookup is not ideal, but could logically accomplish the same thing.
