Tag from cli or search?

[swdonline]

Is it possible to auto-tag a field from the results of a search from the cli or the search bar? Something like:

"search color=scarlet OR color=crimson | tag tag::color=red"

[Kate_Lawrence-G]

Hi,

It's not possible to do it automatically you can do it through the Splunk Web interface:

http://docs.splunk.com/Documentation/Splunk/latest/User/TagAndAliasFieldValues#How_to_tag_and_alias_...

Also if you are running 4.3 you can do some dynamic tagging from the event viewer data:

See http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Tagthehostfield

Thanks,

Kate