topic Custom Source Type - Group by Column in TSV file in Splunk Search

Custom Source Type - Group by Column in TSV file

jaredneedell — Mon, 09 Mar 2020 13:18:42 GMT

I have a TSV file im uploading into Splunk, I'd like to be able to group by a column in the file itself.

So far I'm using the Splunk Source Type UI to create the custom source type, used the field tab to label the columns and I'm missing the step to group by a column.

Can anyone please advise?

Screen shot shows the setup below, I'd like to group by Session

Re: Custom Source Type - Group by Column in TSV file

richgalloway — Mon, 09 Mar 2020 13:39:53 GMT

There is no such step. Grouping by column is done at search time.

Re: Custom Source Type - Group by Column in TSV file

jaredneedell — Mon, 09 Mar 2020 13:43:12 GMT

That doesn't make sense I've seen how to's on how to group when using the old props/transform config files. This is an SMTP server and the TSV files has a multiple line entries for a single session ID.

Re: Custom Source Type - Group by Column in TSV file

jaredneedell — Mon, 09 Mar 2020 17:03:05 GMT

Proceeding with doing this a the search level