Keyby
This topic describes how to use the function in the Splunk Data Stream Processor.
Description
Groups a stream of records by one or more field(s) and returns a grouped stream. Because Keyby
outputs a GroupedBy
stream, this function must be used in conjunction with Merge Events
. This function does not show metrics in the UI.
Syntax
- Keyby
- keys=<fields>
Function Input/Output Schema
- Function Input
collection<record<R>>
- This function takes in collections of records with schema R.
- Function Output
GroupedStream<record<K>, record<V>>
- This function outputs a grouped stream of records with a given schema, K.
Required arguments
- keys
- syntax: <fields>
- Description: The names of the fields to group records.
SPL2 example
Group records by source
...| keyby keys=source |...
Group records by source and host
...| keyby keys=[source, host] |...
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.1.0
Feedback submitted, thanks!