Tag field-value pairs in Search

You might have groups of events with related field-value pairs. To help you search for these events, assign the same tag to these related field-value pairs.

See About tags and aliases.

Tag field-value pairs

You can tag any field-value pair directly from the results of a search.

Prerequisites

• See About tags and aliases for information on tags.

Steps

1. Locate an event with a field-value pair that you want to tag.
2. Expand a row to see the full list of fields extracted from the event.
3. Click the Actions arrow for the field-value pair that you want to create a tag for and select Edit Actions.
4. In the Create Actions dialog box , define one or more tags for the field-value pair.

   Values for the Tag(s) field must be separated by commas or spaces.

   
5. Click Save.

Remove URL-encoded values from tag definitions

When you tag a field-value pair, the value part of the pair cannot be URL-encoded. If your tag has any %## format URL-encoding, decode it and then save the tag with the decoded URL.

For example, you want to give the following field-value pair the tag Useful.

url=http%3A%2F%2Fdocs.splunk.com%2FDocumentation.

Define the tag in Settings.

1. Select Settings > Tags > List by tag name.
2. Click on the Useful tag name to open the detail page for that tag.
3. Under Field-value pair replace url=http%3A%2F%2Fdocs.splunk.com%2FDocumentation with the decoded version: url=http://docs.splunk.com/Documentation.
4. Click Save.

See Define and manage tags in Settings.

Search for tagged field values

You have two ways to search for tags. To search for a tag associated with a value in any field, use the following syntax:

tag=<tagname>

To search for a tag associated with a value in a specific field, use the following syntax:

tag::<field>=<tagname>

Use wildcards to search for tags

You can use the asterisk (*) wildcard when you search keywords and field values, including for eventtypes and tags.

For example, if you have multiple eventtype tags for various types of IP addresses, such as IP-src and IP-dest, you can search for all of them with:

tag::eventtype=IP-*

To find all hosts whose tags contain "local", search for the following tag:

tag::host=*local*

To search for the events with eventtypes that have no tags, you can search for the following Boolean expression:

NOT tag::eventtype=*

Disable and delete tags

You can remove a tag association for a specific field value through the Search app. You can also disable or delete tags, even if they are associated with multiple field values in Settings.

See Define and manage tags in Settings.

Remove a tag association for a specific field value in search results

You can remove a tag associated with a field value in your search results.

1. Click the arrow next to the event.
2. Under Actions, click open the arrow next to the field value.
3. Select Edit Tags to open the Create Tags window.
4. In the Create Tags window, delete the tags that you want to disable from the Tags field.
5. Click Save.

This action removes this tag and field value association from the system. If this is the only field value the tag is associated with, the tag is removed from the system.

Tagging event types in settings

You can add tags when you create or edit an event type. See Tag event types.

Rename source types

When you configure a source type in props.conf, rename the source type. Multiple source types can share the same name,so you can group a set of source types for a search. For example, you can normalize source type names that include "-too_small" to remove the classifier. See Rename source types at search time.