Knowledge Management

Too complex for tags?

jedatt01
Builder

I want to create a tag that involves two extracted fields and a combination of AND/OR statements, see example below.

key/value pair 1
(PolicySetName=policy1 AND (AuthPolicy=auth1 OR AuthPolicy=auth2 OR AuthPolicy=auth3))

key/value pair 2
(PolicySetName=policy2 AND AuthPolicy=auth4)

key/value pair 3
(PolicySetName=policy3 AND AuthPolicy=auth5)

Is this even possible with a tag?

Tags (2)
0 Karma

gcusello
Legend

Set your tags starting from eventtypes creation, assigning a tag to an eventtype as you want complex, don't start from creating a new tags, you'll reach your target.
Bye.
Giuseppe

0 Karma

gcusello
Legend

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...