These allow you to categorize events based on search terms.

Groups is not a Splunk knowledge object type; there is no native Splunk feature called Groups that categorizes events by search terms.

Event Types are saved searches that Splunk evaluates against incoming events at search time; any event matching the search criteria is tagged with that event type name, allowing consistent categorization of events across sourcetypes based on search terms.

Macros are reusable search snippets or shortcuts that expand into SPL at search time; they do not categorize or label events based on matching criteria.

Tags in Splunk are used to assign human-readable labels to specific field-value pairs, not to categorize events by evaluating search expressions against them.