Define Groups

[jasonbreimer]

Add to Docs information on Groups.

In the following example a group is part of the Event Class.

group → For each attribute ensure you add a group value. Valid values are - Classification, Context, Occurrence, Primary

example: "hw_bios_manufacturer": { "description": "The BIOS manufacturer.", "group": "primary", "requirement": "optional" },

[pagbabian-splunk]

There is a subsection on Attribute Groups in the Attributes section of the White Paper. Please take a look, however it isn't a syntax for specifying groups. It could be added in the appendix under Adding / Modifying Attributes. There is also a separate Readme in Schema where it should be added (effectively the same content was lifted for the WP).