Knowledge Management

Tags defined in tags.conf not showing up in GUI

wrangler2x
Motivator

So let's say I have this tag in /opt/splunk/etc/apps/search/local/tags.conf:

[host=x.y.uci.edu]
nac_wsg = disabled
nac_dba = enabled

So now I go into the GUI and under Splunk > Manager >> Tags I click on List by tag name. App context is Search and Owner is Any. I do not see nac_dba or nac_wsg (nor a number of other tags). I only see a few. What is up with that?

Then I go into Splunk > Manager >> Tags and click on List by field value pair. App context is Search and Owner is Any. I do see host=x.y.uci.edu but I do not see anything under Tag Name.

Now I checked that /opt/splunk/etc/system/local/tags.conf is empty, and also that the various users local/tags.conf don't have anything.

This is splunk 4.3.1.

I verified all this after a fresh restart of splunk.

Tags (1)
0 Karma

jbrocks
Communicator

My experience with this:

If you create a tag via commandline or editor, the tag is only shared in app. If you are searching in the search app, the search app has no permission to show this tag. Setting the tags permission to global solved this problem for me. Especially if you use other apps like CIM which work with these tags. Please correct me, if I am wrong.

0 Karma

wrangler2x
Motivator

I've got a technique that works if you run into this problem.

  1. Manager » Tags » All unique tag objects

    • search by hostname
    • delete the tag object
  2. Manager » Tags » List by field value pair

    • search by hostname
    • delete that field value pair
  3. Manager » Tags » List by tag name

    • find the tag you wanted to add the hostname to
    • copy the name of a host from that list
  4. Go to Manager » Tags » All unique tag objects

    • find the hostname you copied from step 3, above, that has the same tag name
    • clone it
    • re-type the tag name (it is cleared on the clone)
    • type or paste-in the new hostname you were trying to add in the first place
    • save it, then find it again.
    • update the permissions
  5. Go back to Manager » Tags » List by field value pair

    • verify it is there (host=hostname) and the permissions
  6. Go back to Manager » Tags » List by tag name

    • search for the tag this host is supposed to be associated with
    • verify the host is in the tag's list.

This is working for me on the stubborn ones.

0 Karma

wrangler2x
Motivator

I believe that we have more clarity on this issue via this other question/comment I posted here: http://answers.splunk.com/comments/246780/view.html

0 Karma

wrangler2x
Motivator

The URL I provided in the previous comment is fubar. I don't know where that particular answer went, and I've searched for it. What it said, in summary, is that if you go to Settings->Tabs->New (next to "List by field value pair") from anywhere within Splunk except the Search app, the likelihood of running into this bugginess goes up dramatically. From the search app it does not seem to happen anymore.

0 Karma

neelamssantosh
Contributor
  1. Make sure those fields are not getting repeated in different tags and
  2. Even if you have,make sure permissions specific to that App only(i mean NOT/Don't make them Global).Though it doesn't even allow to Change permission from Private if its already existing..

Or else,

Create tag in some other app and Move to the respective app to need.
Eg: App:Search tag=nac_dba fields: host=x.y.uci.edu
Make sure if you want to move from Search to Launcher app, u must not be in Launcher app.

0 Karma

wrangler2x
Motivator

I've discovered that not only is it buggy to manually create these entries in /opt/splunk/etc/apps/search/local/tags.conf but it is buggy also to create them via 'Add new' on "List by field value pair".

What does seem to work well is to go to the "all unique tag objects," find one that works, clone it, type in the tag name, and replace the system name with the new one you are adding. Repeat for other tags you need for that system. I'll be interested to see if all this works better in release 5 when I get to it. For now, I am setting this aside.

0 Karma

wrangler2x
Motivator

I am running into this same problem on 'Splunk 5.0.5 build 179365'. I've got a tag I created in "all unique tag objects" by cloning a working one and then updating the host= field. But in "list by tag name" the tag does not contain the new host. Still buggy.

0 Karma

lguinn2
Legend

Perhaps permissions are not properly set for these tags.

0 Karma

wrangler2x
Motivator

It does seem that inconsistent permissions can cause this seemingly buggy behavior, I've found, so that was a good suggestion.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...