Security

Tags Disappear When Changing Permissions

mmclain1
Explorer

I created a tag with a field value pair of host=server1* called test. Everything works great until I try to change the permissions on it so my colleagues can use it. I set the permission from Private to App where everyone can read it and only admin can write. When I save this change, the Tag name disappears, but the field value pair remains.
When I click the field value pair to edit the tags associated with it, I re-add the test tag, save, but the Tag Name area is still blank. What gives?

Tags (2)
0 Karma
1 Solution

emiller42
Motivator

Were you trying to use a wildcard in the tag? (%2A = *)

[host=server1*]
test = enabled

That's not something you can do in tags. Each host=value pair must be explicitly defined. So if you have server10, server11, server12, then you need three separate tags defined.

[host=server10]
test = enabled

[host=server11]
test = enabled

[host=server12]
test = enabled

Yes, this sucks when you have a lot of servers.

View solution in original post

emiller42
Motivator

Were you trying to use a wildcard in the tag? (%2A = *)

[host=server1*]
test = enabled

That's not something you can do in tags. Each host=value pair must be explicitly defined. So if you have server10, server11, server12, then you need three separate tags defined.

[host=server10]
test = enabled

[host=server11]
test = enabled

[host=server12]
test = enabled

Yes, this sucks when you have a lot of servers.

mmclain1
Explorer

Ah, that explains it. Thanks!

mmclain1
Explorer

/opt/splunk/etc/apps/search/local/tags.conf:
[host=server1%2A]
test = enabled

Nothing in the other file.

Also, when I go to "List by tag name", there are no tags listed...

0 Karma

emiller42
Motivator

What are you seeing in tags.conf? Look in both the etc/apps//local folder and etc/users///local.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...