Search notable event with TAG value

[dellytaniasetia]

Hi

I assign a TAG to event_id (notable event) in the Incident Review.

My question is, How to search all the notable event that I tag with value e.g. 'ABC' in the Splunk Search menu, instead of using Tag filter in the Incident review?

It is because I need to export to csv for management report.

Thanks

[kchamplin_splun]

If you run this search:

`notable` | search NOT `suppression` tag=<putyourtaghere>

Where you just replace with the name of your tag. For example I tagged one of my notables with KCHAMP so I used the following:

`notable` | search NOT `suppression` tag=KCHAMP

Let me know if this works for you. If you need to search across multiple tags, simply use an OR statement such as (tag=mytag1 OR tag=mytag2) etc.