Search modifiers
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Search modifiers
Use search modifiers to filter searches using tags, or use search modifiers to add the results of a saved search as an argument to a search.
eventtypetag
You can tag event types based on shared attributes. Use eventtypetag to filter your search to include events that have the specified event type tag (or tags).
Syntax
eventtypetag=string
Arguments
| string | Specify a single tag, or a comma-delimited list of tags. |
hosttag
You can create tags for the host (value of the host field) of events with tags. Use hosttag to filter your search to include events that have hosts that match the specified host tag (or tags).
Syntax
hosttag=string
Arguments
| string | Specify a single tag, or a comma-delimited list of tags. |
savedsearch
Adds the text of the saved search to the arguments of the search command. If the saved search contains more than one command (it contains the pipe character), use the savedsearch command instead of the savedsearch modifier.
Syntax
savedsearch=name_of_saved_search
Arguments
| name_of_saved_search | Specify a saved search. |
tag
You can tag events with tags to help you identify them in your terms. Use tag to filter your search to only include events that match the specified tag (or tags).
Syntax
tag=string
Arguments
| string | Specify a single tag, or a comma-delimited list of tags. |
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 , 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.