topic Splunk Query Grammar in Splunk Search

Splunk Query Grammar

inovexsean — Fri, 25 Jan 2019 18:22:20 GMT

I have a system that receives data from other systems for auditing purposes. One of these systems uses Splunk and I have a need to parse the queries. I am hoping someone can point me to a grammar for the Splunk language (Antlr, BNF, etc.).

Re: Splunk Query Grammar

woodcock — Fri, 25 Jan 2019 19:33:09 GMT

Install splunk and go to the /opt/splunk/etc/system/README/ directory. Poke around in there. You will find all that you need.

Re: Splunk Query Grammar

inovexsean — Fri, 25 Jan 2019 19:36:35 GMT

I'll try, and I appreciate the info, but my terminal here (which is not my development box) is pretty locked-down.

Re: Splunk Query Grammar

chrisyounger — Sat, 26 Jan 2019 09:16:32 GMT

Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db

I generated these by running /opt/splunk/bin/splunk btool searchbnf list on a fairly default Splunk 7.2 instance.

Re: Splunk Query Grammar

inovexsean — Mon, 28 Jan 2019 13:45:08 GMT

Thanks. This'll be a big help.

Re: Splunk Query Grammar

woodcock — Tue, 12 Feb 2019 00:12:06 GMT

Just install Splunk on your local machine and check it out.