I have a TSV file im uploading into Splunk, I'd like to be able to group by a column in the file itself. So far I'm using the Splunk Source Type UI to create the custom source type, used the field tab to label the columns and I'm missing the step to group by a column. Can anyone please advise? Screen shot shows the setup below, I'd like to group by Session ... View more

I'm trying to create a custom source type which is reading a TSV log file and the 3 column in the file is a JSON payload wrapped in quotes. I can't figure out how to get the source type to parse out the 3 column in a JSON format on splunk. Here's an example of a line entry below. 6680 "2020-03-06 13:50:13.254" "{"date":"3/6/2020 1:50:13 PM","received":"from FooServer (Unknown [172.20.36.5]) by smtp-dev.foo.com with ESMTP ; Fri, 6 Mar 2020 13:50:13 -0500","message-id":"id@message.com","from":"foo@thisMachine.com","recipients":"John.Smith@example.com","cc":"","subject":"Test Email"}" Any advice would be helpful, thank you. ... View more