Filter dashboards by tags in the Splunk App for AWS

The Splunk App for AWS dashboards allow you to filter content by the tags you have defined in Amazon Web Services. Tags are custom metadata that you can use to identify and organize your AWS resources. Each of your resources can have up to ten tags, each of which consists of a key and an optional value. See the Reference section below for more information about defining tags in AWS.

Use the tags filter on a dashboard

To use the tags filter, navigate to any Splunk App for AWS dashboard that supports the filter, such as the Overview dashboard. Some dashboards do not include a tags filter, often because the data in that dashboard is not relevant to tags.

1. Click in the Tags field. The app displays all the keys you have defined in AWS.

2. Browse to or search for the key you want.

3. The app displays the key you have selected along with some options for values. You can:

• select is empty to match keys without values.
• select a value from the list
• enter any string, then select Contains: to match all values that contain this string

4. To add an additional tag to the filter, repeat steps 1 - 3. Tags follow AND logic, so the dashboard displays only the data that matches all tags in the filter.

Reference

For more information about how to create tags in AWS, see http://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/tag-editor.html. You can also read the AWS documentation for specific services for more detailed information and best practices for how to apply tags to your resources.

For example, see http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html for information on tagging EC2 resources.