Knowledge Management

Search for data that has not been tagged

sarahw3
Explorer

I have just created 71 eventtypes and I want to see if I left any out. In each eventtype I gave it a tag. In the search, is there a way to search for my data that does not have a tag?

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Later in the search it looks like this...

| where isnull(tag)

I believe on the initial search it would be...

 tag!=*

... or ...

NOT tag=*

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Later in the search it looks like this...

| where isnull(tag)

I believe on the initial search it would be...

 tag!=*

... or ...

NOT tag=*
0 Karma

sarahw3
Explorer

The isnull one worked perfectly! Thank you!

Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...