I've always known that you can't search tag=* but I never knew why. Maybe the old-time splunkers can elighten me?
It's possible to search by tag=*
. Are you getting any error or no results are returned.
I have created a tag for two sourcetypes and both are returned. Splunk just expands the search by substituting each value of tag with OR condition. You can have a look at the job inspector to see your final search and it might provide you the reason. For eg: you have two contradictory searches joined with OR . I
See attached screen shot
It might be a permission issue also . for eg: index by default is not enabled and always have to provide index=yourindex
in the search