Knowledge Management

Why is tag creation not working, but the field/value pair is working?

Communicator

Hi Splunkers,

I have this search host=slc-p-cv01 sourcetype=csv that returns what I expect.

I am trying to make a tag called cv that contains this search.

So I create a tag, in the "Field value pair" I put the above search. In the Tag name, I put cv. I also gave the tag full permissions.

When I perform the search, it works. The tag returns nothing.

Thanks in advance!

Tags (2)
0 Karma
1 Solution

Communicator

This answer explains it well.

https://answers.splunk.com/answers/238355/what-are-the-definitions-of-tag-and-eventtype-and.html

I think what I need is an event type. Apparently a tag is a single key=value pair, where an eventtype can have multiple prepipe statements (which is what I have).

But, correct me if I am wrong, I could do this:

host=slc-p-cv01
tag=cv

sourcetype=csv
tag=cv

And it would be the same thing as

host=slc-p-cv01 sourcetype=csv
eventtype=cv

View solution in original post

0 Karma

Communicator

This answer explains it well.

https://answers.splunk.com/answers/238355/what-are-the-definitions-of-tag-and-eventtype-and.html

I think what I need is an event type. Apparently a tag is a single key=value pair, where an eventtype can have multiple prepipe statements (which is what I have).

But, correct me if I am wrong, I could do this:

host=slc-p-cv01
tag=cv

sourcetype=csv
tag=cv

And it would be the same thing as

host=slc-p-cv01 sourcetype=csv
eventtype=cv

View solution in original post

0 Karma

Communicator

But my event type isn't working either.
alt text

0 Karma

Communicator

Ah, Got it! I had a typo.

0 Karma

Splunk Employee
Splunk Employee

@HCadmins - Sounds like you resolved your issue? If yes, let me know and I will convert your comment as an Answer 🙂

0 Karma

Communicator

I did resolve my own issue. Thanks!

0 Karma

Ultra Champion

Just for curiosity, I'm not sure whether it should be a tag or an eventtype... it bothers me ; -)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!