Define and manage tags in Settings

Splunk software provides multiple methods for tag creation and management. Most users use the simplest method tagging field-value pairs directly in search results. See Tag and alias field values in Search.

Use the Tags page in Settings to manage the tags created by users of your Splunk deployment.

• Manage tags for your Splunk deployment.
• Create tags.
• Disable or delete tags.

Using the Tags page in Settings

The Tags page in Settings gives you three views of your tags. Each view is a different tag organization.

• List by field value pair
• List by tag name
• All unique tag objects

Use these pages to create, edit, or delete tags, and manage the sets of tags that are associated with specific field-value pairs or apps.

Before you create new field-value pair records on the Settings pages for tags, verify that the field-value pairs exist in your data. The Splunk platform does not perform validation to ensure that you are not associating tags to nonexistent field-value pairs.

Managing associations between field-value pairs and tag sets

The List by field-value pair page lists the field-value pairs that are associated with tag sets. On this page you can perform the following actions if the permissions associated with your role allow it:

• Create a new field-value pair record. Click New to provide a field-value pair and one or more tag names.
• Edit the list of tags that are associated with a field-value pair. Click a field-value pair name and add or remove tag names.
• Update permissions for a field-value pair. Click Permissions. The Splunk platform applies field-value pair permission updates to all tags associated with the pair.
• Disable all tags associated with a field-value pair. If you need to remove tags from your search results without deleting them, disable them instead.
• Clone, Move, or Delete an association between a field-value pair and a set of tags.

The List by field-value pair page breaks out field-value pairs by app. If you have the same field-value pair in multiple apps, it appears on multiple rows of the List by field-value pair page. This means you can apply a change to the association between a field-value pair and a set of tags in one app without affecting field-value pairs or tags in other apps..

For example, say you have the same field-value pair in the Search & Reporting and Enterprise Security apps, and in both apps it is associated with the same two tags: tag-a and tag-b. If you disable the association between the field-value pair and the two tags in the Search & Reporting app, the field-value pair will continue to be associated with the tag-a and tag-b in the ES app.

As a knowledge manager, consider using a carefully designed and maintained set of tags. This practice aids with data normalization, and can reduce confusion on the part of your users.

See Manage knowledge objects through Settings pages.

Managing associations between tags and sets of field-value pairs

The List by tag name page lists each of the tags that are in your Splunk platform deployment. It lists each tag once, even if the tag appears in multiple apps or is associated with multiple field-value pairs.

On this page you can perform the following actions if the permissions associated with your role allow it:

• Create new tags. Click New to define a tag name and provide a field-value pair.
• Edit the field-value pair lists for tags. Click the tag name to add, remove, or edit the field-value pairs that are associated with a tag.
• Clone or Delete tags.
• Disable tags.

When you disable a tag through the List by tag name page, the Splunk platform disables the tag across all apps that contain the tag. The row for the disabled tag also disappears from the list. To reenable disabled tags, go to the List by field-value pair page, locate the related field-value pair, and add the name of the disabled tag to it.

The List by tag name page does not allow you to manage permissions for the set of field-value pairs associated with a tag.

As a knowledge manager, consider using a carefully designed and maintained set of tags. This practice aids with data normalization, and can reduce confusion on the part of your users.

See Manage knowledge objects through Settings pages.

Reviewing all unique field-value pair and tag combinations

The All unique tag objects page lists out all of the unique tag name, field-value pairing, and app combinations in your deployment. This page lets you edit one-to-one relationships between tags and field-value pairs. If a tag object is identical to tag objects in other apps, it will appear multiple times in this list, once for each app.

You can search for a particular tag to quickly see all of the field-value pairs with which it's associated, or you can disable or clone a particular tag and field-value association, or you can maintain permissions at that level of granularity.

Disabling and deleting tags

If you have a tag that you no longer want to use, or want to have associated with a particular field-value pairing, you can disable it or remove it.

• Remove a tag association for a specific field-value pair in the search results.
• Bulk disable or delete a tag, even if it is associated to multiple field values, with the List by tag name page.
• Bulk disable or delete the associations between a field-value pair and a set of tags by using the List by field-value pair page.

For information about deleting tag associations with specific field-value pairs in your search results, see Tag field-value pairs in Search.

Delete a tag with multiple field-value pair associations

You can use Splunk Web to remove a tag from your system, even if it is associated with dozens of field-value pairs. This method lets you get rid of all of these associations in one step.

Select Settings > Tags > List by tag name. Delete the tag. If you don't see a delete link for the tag, you don't have permission to delete it. When you delete tags, be aware of downstream dependencies. See Manage knowledge objects through Settings pages.

You can open the edit view for a particular tag and delete a field-value pair association directly.

Disable or delete the associations between a field-value pairing and a set of tags

Use this method to bulk-remove the set of tags that is associated to a field-value pair. This method enables you to get rid of these associations in a single step. It does not remove the field-value pairing from your data, however.

Select Settings > Tags > List by field-value pair. Delete the field-value pair. If you do not see a delete link for the field-value pair, you do not have permission to delete it. When you delete these associations, be aware of downstream dependencies that may be adversely affected by their removal. See Manage knowledge objects through Settings pages.

You can also delete a tag association directly in the edit view for a particular field-value pair.

Disable tags

Depending on your permissions to do so, you can also disable tag and field-value pair associations using the three Tags pages in Settings. When an association between a tag and a field-value pair is disabled, it stays in the system but is inactive until it is enabled again.

When you disable a tag through the List by tag name page, the Splunk platform disables the tag across all apps that contain the tag. The row for the disabled tag also disappears from the list. To reenable disabled tags, go to the List by field-value pair page, locate the related field-value pair, and add the name of the disabled tag to it.