Can I place a TAG within a TAG?

[mrcassout]

Can I place a TAG within a TAG? I am creating different level TAGs, where I have a lower level containing specific server names and then a higher level that I would like to contain several lower level TAGs. Is this possible?

[gcusello]

Hi @mrcassout,
are you're speaking about tags or eventtypes? you can create eventtypes containing other eventtypes or tags, e.g.:
eventtype1 is index=my_index
eventtype2 is eventtype=eventtype1 sourcetype=sourcetypeA and it has associated tagA
eventtype3 is eventtype=eventtype1 sourcetype=sourcetypeB
eventtype4 is eventtype=eventtype1 TAG=tagA

Instead tags are a feature that you associate to an eventtype; to one eventtype you can associate none, one or more eventtypes or tags.

So you can create a tag inside another one working on eventtypes and associating tags to eventtypes

Ciao.
Giuseppe

[efavreau]

Sort of. When you create a tag, you can create multiple tags in the same step by separating them with a comma. Your list of tags could be as creative as you want. i.e. webservers,webserverslinux,webserverslinuxralph

For more information about how this would work, please see this Splunk Education video about Using Tags: https://www.splunk.com/view/SP-CAAAGYJ