Splunk Search

How do you 'Tag' based on a search?

andrewkenth
Communicator

I'm almost certian I used the wrong lingo but I'd like to essentially create a field based on search or regex, but I want my own predetermiend label to be the field value, not any of the contents of the raw log.

So, if I have a search like this:
index=myIndex sourcetype=mysourcetype "dude really did login"

I'd want all of thos results to be tagged with a field named "ServerEvent" and have the value be set to "LOGIN"

Alternativly I'd want a search like this:
index=myIndex sourcetype=mysourcetype "dude really did logout"

I'd want all of thos results to be tagged with a field named "ServerEvent" and have the value be set to "LOGOUT"

What is the most efficient way to do this in Splunk?

Tags (2)
0 Karma
1 Solution

aelliott
Motivator
0 Karma

aelliott
Motivator
0 Karma
Get Updates on the Splunk Community!

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...