Splunk Search

Simply query, failes with field specificity

tlmayes
Contributor

I have what should be a simple problem, but I don't have an answer without burning some brain cells

Simple query example:  index=some_index sourcetype=some_sourcetype.  Returns 140k events

Output of the query above contains the field 'tag', with 7 values, x 30K+ events 

But if I use the query: index=some_index sourcetype=some_sourcetype tag="*"

I get 'zero', no results

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

"tag" is an internal splunk's "meta-field". Tags are applied to events based on field values and are mostly used to create common search criteria for various types of events. So if your events indeed have a field called tag, it overlaps with the "field" name used internally by splunk.

For the same reason you shouldn't use fields named "index", "source" or "sourcetype". I suppose "eventtype" could also cause problems.

yuanliu
SplunkTrust
SplunkTrust

One possibility is that 'tag' is a calculated field.  Open Settings ->  Fields -> Calculated fields to see if this this the case.  (If the field is partially ingested/transformed and partially calculated, the results can be even more puzzling.)

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...