Define Groups

[jasonbreimer]

Add to Docs information on Groups.

In the following example a group is part of the Event Class.

group → For each attribute ensure you add a group value. Valid values are - Classification, Context, Occurrence, Primary

example:
"hw_bios_manufacturer": {
"description": "The BIOS manufacturer.",
"group": "primary",
"requirement": "optional"
},

[pagbabian-splunk]

There is a subsection on Attribute Groups in the Attributes section of the White Paper. Please take a look, however it isn't a syntax for specifying groups. It could be added in the appendix under Adding / Modifying Attributes. There is also a separate Readme in Schema where it should be added (effectively the same content was lifted for the WP).