Getting Data In

Unable to see tags on REST API output

markov00
New Member

I've indexed some web server logs and than I've assigned a tag to the status field, so I can receive the tag name instead of the http status code. It' works correctly on splunk web: I can see for each log it's tag. But when I use the REST API I can't see the tags I associated to the status. Either I can't see the status as a field in the response.
How can I setup my Splunk to output these values?
Thanks
Marco

Tags (3)
0 Karma

chimbudp
Contributor

Hello ,

troubleshoot like,
Make sure that you copied the TAG.CONF file to the application that you are using. (you might be using in SEARCH , not in other app)
Once you create a TAG , you need to REFRESH your SEARCH for the tag to happen.
You can make sure the permissions of the TAG that you create under MANAGER -> TAGS ->List by field value pair

I think this will not create much trouble in tags concept

0 Karma

markov00
New Member

I'm using directly splunk web for configure everything, each tag is set to be used by all the application. As I've written on my first post I can see the tag after I've created them on splunk web, but if I start a the savedSearch from the REST API I don't receive the tag field.

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...