About tags and aliases
In your data, you might have groups of events with related field values. To search more efficiently for these groups of event data, you can assign tags and aliases to your data.
If you tag tens of thousands of items, use field lookups. Using many tags will not affect indexing, but your search has better event categorization when using lookups. For more information on field lookups, see About lookups.
Tags
Tags enable you to assign names to specific field and value combinations, including event type, host, source, or source type.
You can use tags to help you track abstract field values, like IP addresses or ID numbers. For example, you could have an IP address related to your main office with the value 192.168.1.2. Tag that IPaddress
value as mainoffice, and then search for that tag to find events with that IP address.
You can use a tag to group a set of field values together, so that you can search for them with one command. For example, you might find that you have two host names that refer to the same computer. You could give both of those values the same tag. When you search for that tag, events that involve both host name values are returned.
You can give extracted fields multiple tags that reflect different aspects of their identity, which enable you to perform tag-based searches to help you narrow the search results.
Tags example
You have an extracted field called IPaddress
, which refers to the IP addresses of the data sources within your company intranet. You can tag each IP address based on its functionality or location. You can tag all of your routers' IP addresses as router, and tag each IP address based on its location, for example, SF or Building1. An IP address of a router located in San Francisco inside Building 1 could have the tags router, SF, and Building1.
To search for all routers in San Francisco that are not in Building1, use the following search.
tag=router tag=SF NOT (tag=Building1)
Tags and the search-time operations sequence
When you run a search, Splunk software runs several operations to derive knowledge objects and apply them to events returned by the search. Splunk software performs these operations in a specific sequence.
Search-time operation order
Tags come last in the sequence of search-time operations.
Restrictions
The Splunk software applies tags to field/value pairs in events in ASCII sort order. You can apply tags to any field/value pair in an event, whether it is extracted at index time, search time, or added through some other method, such as an event type, lookup, or calculated field.
For more information
For more information about search-time operations, see search-time operations sequence.
Field aliases
Field aliases enable you to normalize data from multiple sources. You can add multiple aliases to a field name or use these field aliases to normalize different field names. The use of Field aliases does not rename or remove the original field name. When you alias a field, you can search for it with any of its name aliases. You can alias field names in Splunk Web or in props.conf. See Create field aliases in Splunk Web.
You can use aliases to assign different extracted field names to a single field name.
Field aliases for all source types are used in all searches, which can produce a lot of overhead over time.
Field Aliases example
One data model might have a field called http_referrer
. This field might be misspelled in your source data as http_referer
. Use field aliases to capture the misspelled field in your original source data and map it to the expected field name.
Field aliases and the search-time operations sequence
Search-time operations order
Field aliasing comes fourth in the search-time operations order, before calculated fields but after automatic key-value field extraction.
Restrictions
Splunk software processes field aliases belonging to a specific host, source, or sourcetype in ASCII sort order. You can create aliases for fields that are extracted at index time or search time. You cannot create aliases for fields that are added to events by search-time operations that come after the field aliasing process.
For more information
For more information about search-time operations, see search-time operations sequence.
Use special parameters in workflow actions | Tag field-value pairs in Search |
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release), 9.2.2406
Feedback submitted, thanks!