It's possible to search by tag=* . Are you getting any error or no results are returned. I have created a tag for two sourcetypes and both are returned. Splunk just expands the search by substituting each value of tag with OR condition. You can have a look at the job inspector to see your final search and it might provide you the reason. For eg: you have two contradictory searches joined with OR . I See attached screen shot It might be a permission issue also . for eg: index by default is not enabled and always have to provide index=yourindex in the search ... View more