Who added a tag to an incident

[Bruce Hadley]

We have a request to identify who added a shared tag to an incident. The specific request is to have it show in the audit history but is there a way to report on who attached a tag?

[Tony Chatfield1]

Hi, checking  System definition > Tags IE table 'label_list' may result in multiple tag records with same label\name.

But if you check the table 'label entries' label_entry_list, you will be able to search the entries for the tag(label)\user\target combination and from there can drill into the label to confirm its creator. 

[Bruce Hadley]

I think we are looking for something much simpler that a normal ServiceDesk manager could see.

[Tony Chatfield1 · Accepted solution]

Looks like tags do not show in task history\audit data, so I would think your options are a view of label_list directly, a view of the label_list via a report, or something like an after insert BR on label_list which would update tag details into the task work_notes.
My recommendation would be a view of label_list.