Tagging Data

[JoshuaJJ]

Good morning, 

 I recently created a tag for a set of hosts. For example, CA for all California hosts. Does this take time to populate or show up within my Data Models?  I am running a search similar to this 

| tstats count FROM datamodel=<data_model>.<root_event> WHERE tag=CA BY _time, host, etc....

I have also tried this 

| datamodel  <data_model> <root_event> search 

| search tag=CA

| table _time, host, etc....

[JoshuaJJ]

Thank you so much for the help. I always forget to add fields to the Data Model 🙂 

[gcusello]

Hi @JoshuaJJ ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @JoshuaJJ ,

two topics:

is tag a field of your DataModel?

You can check this in your DataModel definition.

if not, you cannot use it or you have to modify your DataModel fields.

if yes, you have to use the <your_datamodel> prefix befor tag in the WHERE condition:

| tstats 
     count 
     FROM datamodel=<data_model>.<root_event> 
     WHERE <data_model>.tag=CA 
     BY _time host

Ciao.

Giuseppe