Archive

Splunk Query Grammar

inovexsean
Explorer

I have a system that receives data from other systems for auditing purposes. One of these systems uses Splunk and I have a need to parse the queries. I am hoping someone can point me to a grammar for the Splunk language (Antlr, BNF, etc.).

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db

I generated these by running /opt/splunk/bin/splunk btool searchbnf list on a fairly default Splunk 7.2 instance.

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db

I generated these by running /opt/splunk/bin/splunk btool searchbnf list on a fairly default Splunk 7.2 instance.

View solution in original post

0 Karma

inovexsean
Explorer

Thanks. This'll be a big help.

0 Karma

woodcock
Esteemed Legend

Install splunk and go to the /opt/splunk/etc/system/README/ directory. Poke around in there. You will find all that you need.

0 Karma

inovexsean
Explorer

I'll try, and I appreciate the info, but my terminal here (which is not my development box) is pretty locked-down.

0 Karma

woodcock
Esteemed Legend

Just install Splunk on your local machine and check it out.

0 Karma