Splunk® Enterprise

Knowledge Manager Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Define and manage tags

Splunk provides a set of methods for tag creation and management. Most users will go with the simplest method--tagging field/value pairs directly in search results, a method discussed in detail in "Tag and alias field values," in this manual.

However, as a knowledge manager, you'll probably be using the Tags pages in Manager to curate the various collections of tags created by users of your Splunk implementation. This topic explains how to:

  • Use the tags pages in Manager to manage tags for your Splunk implementation.
  • Create new tags through Manager.
  • Disable or delete tags with Manager.

Navigate to the Tags pages by selecting Manager > Tags.

Using the Tags pages in Manager

The Tags pages in Manager provide three views of the tags in your Splunk implementation:

  • Tags by field value pair(s), which you access by clicking List by field value pair(s) on the Tags page.
  • List by tag name
  • Tags by unique ID, which you access by clicking All tag objects on the tags page.

Each of these pages enables you to manage your tag collection in different ways. They enable you to quickly get a picture of the associations that have been made between tags and field/value pairs over time. They also allow you to create and remove these associations.

Managing tag sets associated with specific field value pairs

What if you want to see a list of all of the field/value pairs in your system that have tags associated with them? Furthermore, what if you want to review and even update the set of tags that are associated with a specific field/value pairing? Or define a set of tags for a particular field/value pair?

The Tags by field value pair(s) Manager page is the answer to these questions. It enables you to review and edit the tag sets that have been associated with particular field/value pairs.

You can also use this page to manage the permissions around the ability to manage a particular field/value combination with tags. See "Manage knowledge object permissions" for more information about setting object permissions.

To see the list of tags for a specific field/value pair, locate that pairing and click on it in the Field::Value column. This takes you to the detail page for the field/value pair.

Here's an example of a set of tags that have been defined for the eventtype=auditd_create field/value pair:

Defining tags for field-value pairs.png

You can add more tags, and delete them as well (if you have the permissions to do so).

When you click New on the Tags by field value pair(s) page, the system enables you to define a set of tags for a new field/value pair.

When you create or update a tag list for a field/value pairing, keep in mind that you may be creating new tags, or associating existing tags with a different kind of field/value pair than they were originally designed to work with. As a knowledge manager you should consider sticking to a carefully designed and maintained set of tags. This practice aids with data normalization, and can reduce confusion on the part of your users. (For more information see "Monitor and organize knowledge objects," in this manual.)

Note: You may want to verify the existence of a field/value pair that you add to the Tags by field/value pair(s) page. The system will not prevent you from defining a list of tags for a nonexistent field/value pair.

Reviewing and updating sets of field value pairs associated with specific tags

What if you want to see a list of all of the tags in your system that have one or more tags associated with them? Furthermore, what if you want to review and even update the set of field/value pairings that are associated with a specific tag? Or define a set of field/value pairings for a new tag?

These questions are answered by the List by tag name Manager page. It enables you to review and edit the sets of field/value pairs that have been associated with specific tags.

This page does not allow you to manage permissions for the set of field/value pairs associated with a tag, however.

To see the list of field/value pairings for a particular tag, locate the tag in the List by tag name, and click on the tag name in the Tag column. This takes you to the detail page for the tag.

Here's an example displaying the various field/value pairings that the modify tag has been associated with.

Defining field-values for tags in manager.png

You can add field/value associations, and delete them as well (if you have the permissions to do so).

When you click New on the List by tag name page, the system enables you to define a set of field/value pairings for a new tag.

When you create or update a set of field/value pairings for a tag, keep in mind that you may be creating new field/value pairings. You may want to verify the existence of field/value pairs that you associate with a tag. The system will not prevent you from adding nonexistent field/value associations.

Be wary of creating new tags. Tags may already exist that serve the purpose you're trying to address. As a knowledge manager you should consider sticking to a carefully designed and maintained set of tags. This practice aids with data normalization, and can reduce confusion on the part of your users. (For more information see "Monitor and organize knowledge objects," in this manual.)

Reviewing all unique field/value pair and tag combinations

The Tags by unique ID page itemizes all of the unique tag name and field/value pairings in your system. Unlike the previous two pages, this page only lets you edit one-to-one relationships between tags and field/value pairs.

You can search on a particular tag to quickly see all of the field/value pairs with which it is associated, or vice versa. This page is useful especially if you want to disable or clone a particular tag and field/value association, or if you want to maintain permissions at that level of granularity.

Disabling and deleting tags

If you have a tag that you no longer want to use, or want to have associated with a particular field/value pairing, you have the option of either disabling it or removing it. If you have the permissions to do so, you can:

  • Remove a tag association for a specific field/value pair in the search results.
  • Bulk disable or delete a tag, even if it is associated to multiple field values, via the List by tag name page.
  • Bulk disable or delete the associations between a field/value pair and a set of tags via the Tags by field value pair(s) page.

For information about deleting tag associations with specific field/value pairs in your search results, see "Tag and alias field values" in this manual.

Delete a tag with multiple field/value pair associations

You can use Splunk Manager to completely remove a tag from your system, even if it is associated with dozens of field/value pairs. This method enables you to get rid of all of these associations in one step.

Navigate to Manager > Tags > List by tag name. Delete the tag. If you don't see a delete link for the tag, you don't have permission to delete it. When you delete tags, try to be aware of downstream dependencies by their removal. For more information, see "Disable or delete knowledge objects," in this manual.

Note: You can also go into the edit view for a particular tag and delete a field/value pair association directly.

Disable or delete the associations between a field/value pairing and a set of tags

Use this method to bulk-remove the set of tags that is associated to a field/value pair. This method enables you to get rid of these associations in a single step. It does not remove the field/value pairing from your data, however.

Navigate to Manager > Tags > Tags by field value pair(s). Delete the field/value pair. If you don't see a delete link for the field/value pair, you don't have permission to delete it. When you delete these associations, try to be aware of downstream dependencies that may be adversely affected by their removal. For more information, see "Disable or delete knowledge objects," in this manual.

Note: You can also go into the edit view for a particular field value and delete a tag association directly.

Disable tags

Depending on your permissions to do so, you can also disable tag and field/value associations using the three Tags pages in Manager. When an association between a tag and a field/value pair is disabled, it stays in the system but is inactive until it is enabled again. For more information, see "Disable or delete knowledge objects," in this manual.

PREVIOUS
Tag and alias field values in Splunk Web
  NEXT
Tag the host field

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Comments

Hi Gowen,<br /><br />Thanks for the feedback. Information on permissions can be found here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Manageknowledgeobjectpermissions.<br /><br />I've added that cross-reference to the documentation above as well. Hope that helps!

Jworthington splunk
September 17, 2013

A page that says "If you have permissions..." or "Depending on your permissions" three times should have some information somewhere about what the permissions are and how to manage them.

Gowen
September 17, 2013

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters