topic Re: What kind of syntax is limit and span? in Splunk Search

What kind of syntax is limit and span?

cotyp — Tue, 11 Jul 2017 02:38:07 GMT

I noticed that limit and span always turn green. What kind of component are they?

For instance: blue is used for commands and orange for clauses

Thanks in advanced!

Re: What kind of syntax is limit and span?

DalJeanis — Tue, 11 Jul 2017 04:00:17 GMT

Those are keyword parameters. max_match= in a rex, keepempty= in a dedup, and count= in makeresults should turn the same color.

Update: per niketnilay's post, splunk terminology appears to be argument.

Verify by checking |sort fieldA desc. If, as expected, desc turns green, then all arguments, not just keyword parameter arguments, are marked green.

Re: What kind of syntax is limit and span?

jkat54 — Tue, 11 Jul 2017 04:17:55 GMT

I agree. In the code behind the scenes (which you get into if you write your own custom spl commands) keywords are key value pairs (this=that) and options are non-key value pairs (I liken them to switches or arguments in command line).

So in this example

| rex mode=sed field=source "s/replacethis/withthis/g"

The keywords are mode=sed & field=source and the option is the sed command.

Re: What kind of syntax is limit and span?

niketn — Tue, 11 Jul 2017 09:01:34 GMT

Syntax highlighting was introduced in version 6.5 and has been enhanced in 6.6 (theme and editing)

Syntax component                           Color    Example
Commands                                   Blue  ...timechart
Command arguments                         Green ...timechart usenull=false
Functions                                 Pink   ...timechart count
Keyword modifiers and Boolean operators Orange   ...timechart count BY productName

http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsingsearches#Color_codes