To search for a tag on a specific field, Splunk requires the syntax tag::<field>=<tagname>.
Extract: "To search for a tag associated with a field, use tag::<field>=<tagname>." Thus, tag::host=prod is correct.