Group
Groups a stream of records by one or more field(s) and returns a grouped stream. Because Group
outputs a GroupedBy
stream, this function must be used in conjunction with Merge Events
. This function does not show metrics in the UI.
- Function Input
collection<record<R>>
- This function takes in collections of records with schema R.
- Function Output
GroupedStream<record<K>, record<V>>
- This function outputs a grouped stream of records with a given schema, K.
Arguments
Argument | Input | Description | UI example |
---|---|---|---|
by | collection<expression<any>> | Choose field values to group events. | get("source_type"); get("source");
|
Full DSL example
This example groups events by source_type, source, and host:
grouped-events = group(events, by: (as(get("source_type"), "source_type"), as(get("source"), "source"), as(get("host"), "host")));
For Each (map) | Merge Events |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.1
Feedback submitted, thanks!