So I have the search:
index=testIndex1 | eval newField=userName+age
I look through the results, set the newField as a selected field so that it can be tagged, and then create a few tags. I then want to search for a tag I just made, tag1. So I try these searches:
index=testIndex1 | eval newField=userName+age | search 'tag::newField'=tag1
index=testIndex1 | eval newField=userName+age | search tag=tag1
But I get "No Results Found" in both cases, what gives? I know the tag exists, because when I go back to the original search, I can see it.
Similarly, when I try to do inline named field extraction and tag based on those fields, I get the same results:
index=testIndex1| rex field=source "/var/log/(?<extractedField1>.*)/(?<extractedField2>.*)/(?<user>.*)/output.log" | search 'tag::user'=fred
I'm thinking there is some order issue with eval/extractions and tags?
... View more