Tag

Learn more about the Cortex Query Language tag stage that adds a single tag or list of tags to the \_tag system field.

Syntax

• Add a single tag:

  | tag add <tag name>

• Add a list of tags:

   | tag add "<tag name1>", "<tag name2>", "<tag name3>",.....

Description

The tag stage is used in combination with the add operator to append a single tag or list of tags to the _tag system field, which you can easily query in the dataset.

Examples

In the xdr_data dataset, add a single tag called "test" to the _tag system field.

dataset = xdr_data
| tag add "test"

In the xdr_data dataset, add a list of tags, "test1", "test2", and "test3", to the _tag system field.

dataset = xdr_data
| tag add "test1", "test2", "test3"