I believe I understand what you want to do now. Normally you would use an alias in order to create a new field with the same value of another field. (ex. If you alias source_ip=ip then you would be able to search for that field by using either of those field names). The problem is that this won't work very well for tags. If you alias a tag then you are creating a new field called severity and that field will contain the value of ANY tag, not only the tags that you want because there is no way to say apply an alias only if the tag is a certain value. For example your severity field could end up something like severity=authentication if the authentication tag is also given to those events.
If you only want to change have the severity field created when those tags contain those values then you could use my previous suggestion.
| eval severity=case(tag==error, "error", tag==info, "info", tag==warning, "warning")
The problem is that you would have to do this to any search that you want it applied to. There is a slightly better way that you could achieve this, and that is by using an automatic lookup.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Knowledge/DefineanautomaticlookupinSplunkWeb
This will allow you to have a field called tag in the lookup and you can have tag=error, tag=info, tag=warning, then you could have another column called severity with the same values. After that put tag as your input field and severity as your output field. Then apply the automatic lookup to the sourcetype, host, or source that you want this to be applied to. Then anytime a tag within that sourcetype, host, or source has the value of any value in your lookup, a field called severity will be created with that value.
Let me know if this helps.
... View more