Security

Tags Disappear When Changing Permissions

mmclain1
Explorer

I created a tag with a field value pair of host=server1* called test. Everything works great until I try to change the permissions on it so my colleagues can use it. I set the permission from Private to App where everyone can read it and only admin can write. When I save this change, the Tag name disappears, but the field value pair remains.
When I click the field value pair to edit the tags associated with it, I re-add the test tag, save, but the Tag Name area is still blank. What gives?

Tags (2)
0 Karma
1 Solution

emiller42
Motivator

Were you trying to use a wildcard in the tag? (%2A = *)

[host=server1*]
test = enabled

That's not something you can do in tags. Each host=value pair must be explicitly defined. So if you have server10, server11, server12, then you need three separate tags defined.

[host=server10]
test = enabled

[host=server11]
test = enabled

[host=server12]
test = enabled

Yes, this sucks when you have a lot of servers.

View solution in original post

emiller42
Motivator

Were you trying to use a wildcard in the tag? (%2A = *)

[host=server1*]
test = enabled

That's not something you can do in tags. Each host=value pair must be explicitly defined. So if you have server10, server11, server12, then you need three separate tags defined.

[host=server10]
test = enabled

[host=server11]
test = enabled

[host=server12]
test = enabled

Yes, this sucks when you have a lot of servers.

mmclain1
Explorer

Ah, that explains it. Thanks!

mmclain1
Explorer

/opt/splunk/etc/apps/search/local/tags.conf:
[host=server1%2A]
test = enabled

Nothing in the other file.

Also, when I go to "List by tag name", there are no tags listed...

0 Karma

emiller42
Motivator

What are you seeing in tags.conf? Look in both the etc/apps//local folder and etc/users///local.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...