Knowledge Management

Search for data that has not been tagged

sarahw3
Explorer

I have just created 71 eventtypes and I want to see if I left any out. In each eventtype I gave it a tag. In the search, is there a way to search for my data that does not have a tag?

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Later in the search it looks like this...

| where isnull(tag)

I believe on the initial search it would be...

 tag!=*

... or ...

NOT tag=*

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Later in the search it looks like this...

| where isnull(tag)

I believe on the initial search it would be...

 tag!=*

... or ...

NOT tag=*
0 Karma

sarahw3
Explorer

The isnull one worked perfectly! Thank you!

Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...