Knowledge Management

What are the definitions of Tag and Eventtype and what are the differences between the two?

kedjjang
Explorer
  1. What is the definition of the [Tag] is?

  2. What is the definition of the [Eventtype] is?

  3. What is the point of difference between the [Tag] and [eventtype] is?

Tags (2)
1 Solution

woodcock
Esteemed Legend

An eventtype is a search that runs when you specify eventtype=MyEventType; you can think of it like a "pipeless, parameterless macro" or even like a saved search.

A tag is a not-necessarily-unique "nametag" given to a specific, definitive (wildcardless) Key-value-pairing. It is very much like an eventtype but it has the following differences:

An instance of an eventtype name is defined by a single directive inside a single eventtypes.conf file but an instance of a tag name can be defined in an infinite number of separate tags.conf files.

An eventtype definition can use wildcards and have any number of pre-pipe specifications (conjunctions) but a tag definition always contains a singlekey=value pairing.

There is an extremely high degree of use-case overlap between the 2 constructs. For example, if you would like to identify all lab servers you could create a single eventtype like this:

[LAB_EVENTS]
search = host=LAB* OR host=xyz OR host=PDQ

Then you search like this:

eventtype=LAB_EVENTS

Or you could use several tags like this:

[host=LAB1]
lab=enabled
[host=LAB2]
lab=enabled
[host=LAB3]
lab=enabled
[host=xyz]
lab=enabled
[host=PDQ]
lab=enabled

Then you search like this:

tag="lab"

View solution in original post

woodcock
Esteemed Legend

An eventtype is a search that runs when you specify eventtype=MyEventType; you can think of it like a "pipeless, parameterless macro" or even like a saved search.

A tag is a not-necessarily-unique "nametag" given to a specific, definitive (wildcardless) Key-value-pairing. It is very much like an eventtype but it has the following differences:

An instance of an eventtype name is defined by a single directive inside a single eventtypes.conf file but an instance of a tag name can be defined in an infinite number of separate tags.conf files.

An eventtype definition can use wildcards and have any number of pre-pipe specifications (conjunctions) but a tag definition always contains a singlekey=value pairing.

There is an extremely high degree of use-case overlap between the 2 constructs. For example, if you would like to identify all lab servers you could create a single eventtype like this:

[LAB_EVENTS]
search = host=LAB* OR host=xyz OR host=PDQ

Then you search like this:

eventtype=LAB_EVENTS

Or you could use several tags like this:

[host=LAB1]
lab=enabled
[host=LAB2]
lab=enabled
[host=LAB3]
lab=enabled
[host=xyz]
lab=enabled
[host=PDQ]
lab=enabled

Then you search like this:

tag="lab"

View solution in original post

anwarmian
Communicator

Nice examples, Woodcock!!!  Eventtype is quite easy to understand but tag with enabled/disabled <field><value> is not always clear to a lot of people.   

On, the other hand, the whole eventtype can also be tagged in tags.conf like the following

[eventtype=LAB_EVENTS]
lab = enabled

0 Karma

realsplunk
Motivator

Great explanation woodcock, could you give sample results based on those event types and tags?

Thanks.

0 Karma

woodcock
Esteemed Legend

Look at how the Common Information Model app uses each:
https://docs.splunk.com/Documentation/CIM/latest/User/Overview

0 Karma

ddrillic
Ultra Champion

@realsplunk, please keep in mind that Event types are intended for data classification whereas Tags are for data normalization - so, from design perspective, they are very different.

woodcock
Esteemed Legend

I disagree. I use tags for classification all the time; for example a host can be either production or development.

0 Karma

HeinzWaescher
Motivator

Is there a big difference regarding the performance between eventypes and tags?

arihant16cse
Path Finder

can you tell me when i will use tags and when used eventtypes

0 Karma

woodcock
Esteemed Legend

Use tags when you don't need wildcards. Use eventtypes when you do need wildcards. Always prefertags`.

0 Karma

woodcock
Esteemed Legend

Check out the Knowledge Object Explorer app. With a small number, there is no difference but the more apps and configurations you add, there can be HUGE performance differences between the two.
https://splunkbase.splunk.com/app/2871/

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!