Which of the following statements about tags is true?

Which of the following statements about tags is true?
A . Tags are case insensitive.
B . Tags are created at index time.
C . Tags can make your data more understandable.
D . Tags are searched by using the syntax tag:: <fieldneme>

View Answer

Answer: C

Explanation:

Tags are aliases or alternative names for field values in Splunk. They can make your data more understandable by using common or descriptive terms instead of cryptic or technical terms. For example, you can tag a field value such as “200” with “OK” or “success” to indicate that it is a HTTP status code for a successful request. Tags are case sensitive, meaning that “OK” and “ok” are different tags. Tags are created at search time, meaning that they are applied when you run a search on your data. Tags are searched by using the syntax tag::<tagname>, where <tagname> is the name of the tag you want to search for.