Tag being applied to all events even with no matching event type

[responsys_cm]

I'm working with the Linux audit daemon and trying to make it CIM compliant. I have tagged all of the events that represent changes to the system with tag="change".

If I search on sourcetype=auditd NOT tag="change" I get no results.

However, if I search on sourcetype=auditd type="SERVICE_*" | stats count by eventtype,tag, I get the following results:

err0r error 1
nix_errors error 1

If I search on sourcetype=auditd type="SERVICE_*" AND tag=change | stats count by eventtype,tag, I see event types for groupadd and useradd applying the change tag to the events.

If I search on sourcetype=auditd type="SERVICE_*" AND eventtype=useradd, I get no results.

If I search on sourcetype=auditd type="SERVICE_*" AND tag=management (or any other tag applied by the useradd or groupadd event types except for change), I get no results.

How on earth are all my auditd events getting tagged with "change" even though there is no event type that captures all of those events and tags them with "change".

Splunk 7.0.0 on OEL 7.

[DavidHourani]

You mentioned :
"I have tagged all of the events that represent changes to the system with tag="change"."
And then :
"How on earth are all my auditd events getting tagged with "change" even though there is no event type that captures all of those events and tags them with "change"."

What's the config for the event type that you are tagging ? Are you sure that the event type isn't matching more than what you need ? Can you share the event type/tag config here ?
Also in your tag config, run a search for the "change" keyword and see if it's being applied to events that are not required.

Regards,
David

[nickhills]

Do you have Splunk_TA_nix installed?

I think the TA adds a modify tag to (pretty much) everything from auditd.
I wonder if something else is coalescing modify & change