Splunk Search

Simply query, failes with field specificity

tlmayes
Contributor

I have what should be a simple problem, but I don't have an answer without burning some brain cells

Simple query example:  index=some_index sourcetype=some_sourcetype.  Returns 140k events

Output of the query above contains the field 'tag', with 7 values, x 30K+ events 

But if I use the query: index=some_index sourcetype=some_sourcetype tag="*"

I get 'zero', no results

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

"tag" is an internal splunk's "meta-field". Tags are applied to events based on field values and are mostly used to create common search criteria for various types of events. So if your events indeed have a field called tag, it overlaps with the "field" name used internally by splunk.

For the same reason you shouldn't use fields named "index", "source" or "sourcetype". I suppose "eventtype" could also cause problems.

yuanliu
SplunkTrust
SplunkTrust

One possibility is that 'tag' is a calculated field.  Open Settings ->  Fields -> Calculated fields to see if this this the case.  (If the field is partially ingested/transformed and partially calculated, the results can be even more puzzling.)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...