topic Re: Why is Splunk Search Assistant highlighting certain words from my description in green color? in Dashboards & Visualizations

Why is Splunk Search Assistant highlighting certain words from my description in green color?

umairahmad3985 — Tue, 24 Dec 2019 11:52:57 GMT

I am using searchbnf.conf file to provide help on my custom search commands but the search assistant is highlighting certain words from my description in green color which is not intended. How can I disable this or are there any escape characters I can use to ask Splunk to not highlight this?

Here's what my search assistant is showing:

And here is the entry in my searchbnf.conf file:

[snxapiquota-command]
syntax = snxapiquota
description = Find information about your API quota, like current usage, quota left etc.
example = | snxapiquota
usage = public

Re: Why is Splunk Search Assistant highlighting certain words from my description in green color?

anmolpatel — Tue, 17 Mar 2020 00:43:15 GMT

@umairahmad3985 unable to replicate it on Splunk7.3.4. What Splunk version are you running ?

Re: Why is Splunk Search Assistant highlighting certain words from my description in green color?

malvidin — Thu, 06 Aug 2020 19:24:18 GMT

It appears to happen with all uppercase words. I have not found a way around it yet.

Re: Why is Splunk Search Assistant highlighting certain words from my description in green color?

malvidin — Thu, 06 Aug 2020 19:39:05 GMT

I tried the following, with no luck.

AAAA _BBBB_ \CCCC "DDDD" 'EEEE' `FFFF`

I was surprised to see backslashes escaped, and the underscore after BBBB is highlighted but the underscore after is not.

Re: Why is Splunk Search Assistant highlighting certain words from my description in green color?

malvidin — Thu, 06 Aug 2020 20:00:46 GMT

I replicated this issue with Splunk versions 7.2 and 8.0.

Re: Why is Splunk Search Assistant highlighting certain words from my description in green color?

thambisetty — Thu, 06 Aug 2020 20:06:54 GMT

That’s because the command is not developed by Splunk. Its 3rd party command.

Re: Why is Splunk Search Assistant highlighting certain words from my description in green color?

malvidin — Thu, 06 Aug 2020 20:21:20 GMT

I think there is a misunderstanding. This is a discussion on how the Splunk searchbnf.conf parser has undocumented and unwanted behavior, not about any particular app or any 3rd party commands.

Re: Why is Splunk Search Assistant highlighting certain words from my description in green color?

malvidin — Fri, 07 Aug 2020 15:50:18 GMT

For the highlighting, it appears that it has affected Splunk as well. You can look at the shelper response to see the raw text, so the highlighting appears to be in the browser, not in the backend.

Note: if you want to use the "or" ("|") command regex (field("="|"!="))?((\")?string(\")?)

If you look at the chart command, it does the same to the BY/OVER that is capitalized in the source.

Re: Why is Splunk Search Assistant highlighting certain words from my description in green color?

lstewart_splunk — Mon, 17 Aug 2020 16:48:04 GMT

The default searchbnf.conf file located here in $SPLUNK_HOME/etc/system/default

Says this:

UPPERCASETERMS and quoted terms are put into <code/>

So when you have something like CSV, PDF, "myindex" the text appears in green color.

Sincerely,

Laura Stewart

Principal Technical Writer – Search Processing Language (SPL)

Re: Why is Splunk Search Assistant highlighting certain words from my description in green color?

malvidin — Mon, 17 Aug 2020 18:28:19 GMT

That is there, under the "DESCRIPTION FORMATTING" section.

The earlier "FORMATTING" section states to use \" to represent a quote. This is not directly aligned with the Description Formatting and does not work in a description.

The "\" is also shown as "\\", which is not documented.

Based on the descriptions shown above that were written by Splunk, it appears that this behavior was not understood by Splunk authors, or the parsing behavior changed and the descriptions were not updated.

The only concern I have with @lstewart_splunk's accurate answer, is that the current behavior breaks the description syntax for stock Splunk commands, as shown above for regex. The Splunk authors for the regex syntax apparently expected that (\")?string(\")? would be shown as (")?string(")?, but instead, it is strangely highlighted.