I am somewhat new to tags as a "Knowledge Management" tool, and I am reviewing the tags configured on my SPLUNK search head, and totally confused by the following situation... From the GUI, I go to Manage -> Tags -> List by tag name. I see a particular tag (let's call it tag1) that is listed twice, with different field-value pairs. In one row, it includes two field-value pairs, and in the other it includes about 60 field-value pairs. In both definitions, the owner and the app are the same (admin, search). Is this viable? If so, if I were logged in as admin, and I used this tag in a search, which set of field-value pairs would it use?
Thanx for any clarification...
well the tags could conceivablely be the same but they could apply to different sources/sourcetypes or applications. So even if they have the same owner they could do different things.
when running a search it would depends on which one of these tags applies to the search.