Knowledge Management

Search for data that has not been tagged

sarahw3
Explorer

I have just created 71 eventtypes and I want to see if I left any out. In each eventtype I gave it a tag. In the search, is there a way to search for my data that does not have a tag?

0 Karma
1 Solution

DalJeanis
Legend

Later in the search it looks like this...

| where isnull(tag)

I believe on the initial search it would be...

 tag!=*

... or ...

NOT tag=*

View solution in original post

0 Karma

DalJeanis
Legend

Later in the search it looks like this...

| where isnull(tag)

I believe on the initial search it would be...

 tag!=*

... or ...

NOT tag=*
0 Karma

sarahw3
Explorer

The isnull one worked perfectly! Thank you!

Get Updates on the Splunk Community!

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...