What is the default order for tag usage?

[follings]

I am trying to understand the order for tag usage in a search.

I have a user with a saved search in their user context that is using a tag. The tag does not exist in the user/application context nor does it exist in application context, but the tag does exist in other applications.

To illustrate:

Saved search exists in user/search: bob/app1 with a tag=proxy.

The tag does not exist for the user/app bob/app1, nor does it exist in application app1.

The tag does exist in applications app3, app5, and search, each with a different variation.

My question is, which tag(s) should the saved search use?

[solarboyz1 · Accepted solution]

For any objects, how and if they are used depends on....

• Context - How is the tag shared, private, app, global.

IF the tag defined in app3 is only shared to app3, it won't impact Bob's search run from App2.

• Permissions -

Bob can only use the tags that Bob's user role has permissions to.

• Precedence -

If identical objects are configured in multiple apps, which configuration is used is based on precedence

1. System local directory -- highest priority
2. App local directories
3. App default directories
4. System default directory -- lowest priority

That's the background...now you could look through all the configs and figure it out yourself or... use btool
https://docs.splunk.com/Documentation/Splunk/7.2.4/Troubleshooting/Usebtooltotroubleshootconfigurati...

So, here is how to look for the tag=proxy for user Bob in the Search app:

$ ./splunk btool --debug --user=Bob --app=search tags list tag=proxy
/opt/splunk/etc/apps/testapp/default/tags.conf [tag=proxy]
/opt/splunk/etc/apps/testapp/default/tags.conf proxy = enabled

By using --debug, it will show you which file the settings Bob will use come from.
In this case you can tell that all the setting Bob will use for this Tag from from testapp.