Knowledge Management

Tags: Whats the best way to see all that is tagged

Michael_Wilde
Splunk Employee
Splunk Employee

I am working on a project where several people are going in to a Splunk server and tagging hosts. (Tagging is used, in this case to denote the person responsible for extracting fields on a host AND to set the state of tagging.. like "done" or "in process".

Is there a smart way to see all hosts that have been tagged, what their tags are (and conversely, which hosts haven't been tagged).

I know i could do a search on "* NOT (host::tag::fx_done OR host::tag::fx_wip)" but that wouldn't be efficient as I don't really need events.. just metadata.

Previous versions of Splunk had the tags listed next to host metadata on the Summary page.

Thoughts?

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
| metadata type=hosts | tags | search NOT (tag::host=fx_done OR tag::host=fx_wip)

will add the tags for each host to the metadata as an MV field, and then you can search on them.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee
| metadata type=hosts | tags | search NOT (tag::host=fx_done OR tag::host=fx_wip)

will add the tags for each host to the metadata as an MV field, and then you can search on them.

gilescope
Explorer

Is there a way of subsetting to the tags definined in a particular app?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

huh, what do you know. totally undocumented. i wonder if it's supposed to be.

0 Karma

Michael_Wilde
Splunk Employee
Splunk Employee

I didnt' think | tags was still a search command. It doesn't show up in the search assistant. I should have just tried it.. but then again, its a worthy question for others to know. Thanks for the answer G.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

the tags command is the same one that was used to retrieve and display the tags in the dashboards in 3.x, and still works in 4.x. It's just the dasboards have changed and no longer display them.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...