Why can't you use a wildcard when searching for tags (tag=*)?

[fmarquez-miles_]

I've always known that you can't search tag=* but I never knew why. Maybe the old-time splunkers can elighten me?

[renjith_nair]

It's possible to search by tag=*. Are you getting any error or no results are returned.

I have created a tag for two sourcetypes and both are returned. Splunk just expands the search by substituting each value of tag with OR condition. You can have a look at the job inspector to see your final search and it might provide you the reason. For eg: you have two contradictory searches joined with OR . I

See attached screen shot

It might be a permission issue also . for eg: index by default is not enabled and always have to provide index=yourindex in the search