Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Split event before apply profiling

$
0
0
Hi all, I have events tagged with *tag1* and others with *tag2*. In the *restricted search terms of the search* in roles, I have `NOT tag=tag1` so users can't see *tag1* events. The problem is when an event contains both tags, so users cannot see the events and they should. Is there any way to split that events by tag in order that users are able to see those which contains *tag2*? Thanks in advance.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>