What is the correct syntax to search for a tag associated with a value on a specific fields?

The correct answer is D. Tag::<filed>=<tagname>. In Splunk, the correct syntax to search for a tag that is associated with a specific value on a specific field is tag::<fieldname>=<tagname>. For example, tag::src_ip=server would find events where the field src_ip has been tagged with the value 'server'. The double-colon :: sepa

Creating Tags and Event Types

Question

Options

ATag-<field?
BTag<filed(tagname.)
CTag=<filed>::<tagname>
DTag::<filed>=<tagname>

How the community answered

(60 responses)

A
2% (1)
C
3% (2)
D
95% (57)

Explanation

In Splunk, the correct syntax to search for a tag that is associated with a specific value on a specific field is tag::<fieldname>=<tagname>. For example, tag::src_ip=server would find events where the field src_ip has been tagged with the value 'server'. The double-colon :: separates the tag keyword from the field name, and = maps it to the tag value.

Topics

#Splunk Tagging#Search Syntax#Field Tagging#Searching Tags

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice