tags.conf in an app/local/tags.conf not working

[hartfoml]

I have an app that I built for a user group. There log on will be restricted by tags. I put the tags.conf file in there app so that I can edit it easily when needed. I ran the (http(s)://splunk_server:port/en-US/debug/refresh) to get the tags running but I am still getting an "Unable to find tag" error during the search's that were built for there app.

Does the tags.conf need to be in system or search app???

[alacercogitatus · Accepted solution]

The tags need to be exported to the system if you are going to use them for logon restriction (just my feeling). If only limited to the specific app, then when they navigate to another app, the tags won't be found. Add this into your metadata/local.meta.conf file.

[tags]
access = read : [ * ], write : [ admin ]
export = system

[hartfoml]

This makes sense but I am getting the can't find tag even while in the app. I added the lines above and there was not change. still getting the "unable to find tag" while in the app.

[alacercogitatus]

Are you sure the tag is defined correctly? Please paste the tags.conf as well as your restriction configuration.

[hartfoml]

[BKUP]

na = enabled

[DA02]

na = enabled

[F01]

na = enabled

[OPS1]

na = enabled

[S02]

na = enabled

in the restrictions I put this

index=os AND tag="na"

[alacercogitatus]

You have to specify a field name. http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/tagsconf

[host=BKUP]
na = enabled

[host=DA02]
na = enabled

And so on and so forth. Once you have the fields defined - a debug/refresh?entity=admin/tags should pull it in for you to use.