Module 9: Working with Tags and Event Types Flashcards
Describe what a tag is?
- Tags are like nicknames that you create for related field/value pairs
- Tags make your data more understandable and less ambiguous
- You can create one or more tags for any field/value combination
- Tags are case sensitive
How do you create a tag?
- Click on the arrow for event details
- Under Actions, click the down arrow
- Select Edit TAgs
- Name the tags, separated by commas
When tagged field/value pairs are selected, the tags appear how?
- In the results as tags
- In parentheses next to the associated field/value pairs
How do you use tags in a search?
Use the syntax: tag=
To search for a tag associated with a value:
- tag=
example: tag=privileged
To search for a tag associated with a value on a specific field:
- tag::=
example: tag::user=privileged
To search for a tag using a partial field value:
- use (*) wildcard
example: tag=p*
How do you manage tags when list by field value pair?
- settings
- tags
- list by field value pair
You can also: - edit permissions
- disable all tags for pair - disables the tag in searches and prevents it from being listed under List by Tag Name and All unique tag objects
How do you add/change the tag name?
Click list by field value pair to add another tag or change the name of the tag
How do you add/change the field value pair?
Click list by tag name to add or edit the field value pair for the tag
Describe event types?
- A method of categorizing events based on a search
- A useful method for institutional knowledge capturing and sharing
- Can be tagged to group similar types of events
How do you create an event type from the search page?
- Run a search and verify that all results meet your event type criteria
- From the save as menu, select event type
- Provide a name for your event type (name should not contain spaces)
How would you use the event type builder?
- From the event details, select event actions > build event type
- Refine the criteria for your event type such as
- search string
- field values
- tags - Verify your selections and click save
Must be a basic search (cannot contain pipes or subsearches)
How would you verify the event type?
Search for eventtype=web_error
Where does the event type display?
In the Fields sidebar and can be added as a selected field