Hi @jip31,
which search did you run:
tag="a"
or
index=your_index tag="a"
?
if you didn't inserted the index in the eventtype, you don't have it in the tag search and probably your index isn't in the default search path.
Try to add the index in the eventtype (also index=* if you don't want to associate the tag to a specific index) and try again.
Ciao.
Giuseppe
Hi @jip31,
let me understand:
you created an eventtype like the following
counter="a"
and you associated to this eventtype a tag called "a" then, when you run a search where this field is present, you don't see the value "a" in the tag field, or the search tag="a" hasn't any result, is it correct?
did you check if in the results of the search that you're analyzing the counter field is present?
then, are you sure about the exact value of tag? tag field is case sensitive.
Ciao.
Giuseppe
hi
I can see the tag
But when I am doing tag="a", i have no results
Hi @jip31,
which search did you run:
tag="a"
or
index=your_index tag="a"
?
if you didn't inserted the index in the eventtype, you don't have it in the tag search and probably your index isn't in the default search path.
Try to add the index in the eventtype (also index=* if you don't want to associate the tag to a specific index) and try again.
Ciao.
Giuseppe
index=mem tag=a return results but not tag=a
you are right, when I add the tage add the index level tag=a works
Hi @jip31,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉