So let's say I have this tag in /opt/splunk/etc/apps/search/local/tags.conf:
[host=x.y.uci.edu]
nac_wsg = disabled
nac_dba = enabled
So now I go into the GUI and under Splunk > Manager >> Tags I click on List by tag name. App context is Search and Owner is Any. I do not see nac_dba or nac_wsg (nor a number of other tags). I only see a few. What is up with that?
Then I go into Splunk > Manager >> Tags and click on List by field value pair. App context is Search and Owner is Any. I do see host=x.y.uci.edu but I do not see anything under Tag Name.
Now I checked that /opt/splunk/etc/system/local/tags.conf is empty, and also that the various users local/tags.conf don't have anything.
This is splunk 4.3.1.
I verified all this after a fresh restart of splunk.
My experience with this:
If you create a tag via commandline or editor, the tag is only shared in app. If you are searching in the search app, the search app has no permission to show this tag. Setting the tags permission to global solved this problem for me. Especially if you use other apps like CIM which work with these tags. Please correct me, if I am wrong.
I've got a technique that works if you run into this problem.
Manager » Tags » All unique tag objects
Manager » Tags » List by field value pair
Manager » Tags » List by tag name
Go to Manager » Tags » All unique tag objects
Go back to Manager » Tags » List by field value pair
Go back to Manager » Tags » List by tag name
This is working for me on the stubborn ones.
I believe that we have more clarity on this issue via this other question/comment I posted here: http://answers.splunk.com/comments/246780/view.html
The URL I provided in the previous comment is fubar. I don't know where that particular answer went, and I've searched for it. What it said, in summary, is that if you go to Settings->Tabs->New (next to "List by field value pair") from anywhere within Splunk except the Search app, the likelihood of running into this bugginess goes up dramatically. From the search app it does not seem to happen anymore.
Or else,
Create tag in some other app and Move to the respective app to need.
Eg: App:Search tag=nac_dba fields: host=x.y.uci.edu
Make sure if you want to move from Search to Launcher app, u must not be in Launcher app.
I've discovered that not only is it buggy to manually create these entries in /opt/splunk/etc/apps/search/local/tags.conf but it is buggy also to create them via 'Add new' on "List by field value pair".
What does seem to work well is to go to the "all unique tag objects," find one that works, clone it, type in the tag name, and replace the system name with the new one you are adding. Repeat for other tags you need for that system. I'll be interested to see if all this works better in release 5 when I get to it. For now, I am setting this aside.
I am running into this same problem on 'Splunk 5.0.5 build 179365'. I've got a tag I created in "all unique tag objects" by cloning a working one and then updating the host= field. But in "list by tag name" the tag does not contain the new host. Still buggy.
Perhaps permissions are not properly set for these tags.
It does seem that inconsistent permissions can cause this seemingly buggy behavior, I've found, so that was a good suggestion.