Tag field-value pairs in Search
You might have groups of events with related field-value pairs. To help you search for these events, assign the same tag to these related field-value pairs.
Tag field-value pairs
You can tag any field-value pair directly from the results of a search.
- See About tags and aliases for information on tags.
- Locate an event with a field-value pair that you want to tag.
- Expand a row to see the full list of fields extracted from the event.
- Click the Actions arrow for the field-value pair that you want to create a tag for and select Edit Actions.
- In the Create Actions dialog box , define one or more tags for the field-value pair.
- Values for the Tag(s) field must be separated by commas or spaces.
- Click Save.
Remove URL-encoded values from tag definitions
When you tag a field-value pair, the value part of the pair cannot be URL-encoded. If your tag has any
%## format URL-encoding, decode it and then save the tag with the decoded URL.
For example, you want to give the following field-value pair the tag Useful.
Define the tag in Settings.
- Select Settings > Tags > List by tag name.
- Click on the Useful tag name to open the detail page for that tag.
- Under Field-value pair replace
url=http%3A%2F%2Fdocs.splunk.com%2FDocumentationwith the decoded version:
- Click Save.
Search for tagged field values
You have two ways to search for tags. To search for a tag associated with a value in any field, use the following syntax:
To search for a tag associated with a value in a specific field, use the following syntax:
You can use the asterisk (
*) wildcard when you search keywords and field values, including for eventtypes and tags.
For example, if you have multiple eventtype tags for various types of IP addresses, such as
IP-dest, you can search for all of them with:
To find all hosts whose tags contain "local", search for the following tag:
To search for the events with eventtypes that have no tags, you can search for the following Boolean expression:
You can remove a tag association for a specific field value through the Search app. You can also disable or delete tags, even if they are associated with multiple field values in Settings.
Remove a tag association for a specific field value in search results
You can remove a tag associated with a field value in your search results.
- Click the arrow next to the event.
- Under Actions, click open the arrow next to the field value.
- Select Edit Tags to open the Create Tags window.
- In the Create Tags window, delete the tags that you want to disable from the Tags field.
- Click Save.
This action removes this tag and field value association from the system. If this is the only field value the tag is associated with, the tag is removed from the system.
Tagging event types in settings
You can add tags when you create or edit an event type. See Tag event types.
Rename source types
When you configure a source type in
props.conf, rename the source type. Multiple source types can share the same name,so you can group a set of source types for a search. For example, you can normalize source type names that include "-too_small" to remove the classifier. See Rename source types at search time.
About tags and aliases
Define and manage tags in Settings
This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5