Splunk Search

Custom Source Type - Group by Column in TSV file

jaredneedell
Explorer

I have a TSV file im uploading into Splunk, I'd like to be able to group by a column in the file itself.

So far I'm using the Splunk Source Type UI to create the custom source type, used the field tab to label the columns and I'm missing the step to group by a column.

Can anyone please advise?

Screen shot shows the setup below, I'd like to group by Session

alt text

0 Karma
1 Solution

jaredneedell
Explorer

Proceeding with doing this a the search level

View solution in original post

0 Karma

jaredneedell
Explorer

Proceeding with doing this a the search level

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no such step. Grouping by column is done at search time.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jaredneedell
Explorer

That doesn't make sense I've seen how to's on how to group when using the old props/transform config files. This is an SMTP server and the TSV files has a multiple line entries for a single session ID.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...