Splunk Cloud

Search Reference

Download manual as PDF

Download topic as PDF

tags

Description

Annotates specified fields in your search results with tags. If there are fields specified, only annotate tags for those fields. Otherwise, look for tags for all fields. If outputfield is specified, the tags for all fields will be written to this field. If outputfield is specified, inclname and inclvalue control whether or not the field name and field values are added to the output field. By default only the tag itself is written to the outputfield, that is (<field>::)?(<value>::)?tag .

Syntax

tags [outputfield=<field>] [inclname=<bool>] [inclvalue=<bool>] <field-list>

Required arguments

<field-list>
Syntax: <field> <field> ...
Description: Specify the fields to annotate with tags.

Optional arguments

outputfield
Syntax: outputfield=<field>
Description: If specified, the tags for all fields will be written to this field. Otherwise, the tags for each field will be written to a field named tag::<field>.
inclname
Syntax: inclname=T|F
Description: If outputfield is specified, controls whether or not the field name is added to the output field.
Default: F
inclvalue
Syntax: inclvalue=T|F
Description: If outputfield is specified, controls whether or not the field value is added to the output field.
Default: F

Examples

Example 1:

Write tags for host and eventtype fields into tag::host and tag::eventtype.

... | tags host eventtype

Example 2:

Write new field test that contains tags for all fields.

... | tags outputfield=test

Example 3:

Write tags for host and sourcetype into field test in the format host::<tag> or sourcetype::<tag>.

... | tags outputfield=test inclname=t host sourcetype

See also

eval

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the tags command.

PREVIOUS
table
  NEXT
tail

This documentation applies to the following versions of Splunk Cloud: 6.6.3, 7.0.0, 7.0.2, 7.0.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters