Splunk Query Grammar

[inovexsean]

I have a system that receives data from other systems for auditing purposes. One of these systems uses Splunk and I have a need to parse the queries. I am hoping someone can point me to a grammar for the Splunk language (Antlr, BNF, etc.).

[chrisyounger · Accepted solution]

Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db

I generated these by running /opt/splunk/bin/splunk btool searchbnf list on a fairly default Splunk 7.2 instance.

[inovexsean]

Thanks. This'll be a big help.

[woodcock]

Install splunk and go to the /opt/splunk/etc/system/README/ directory. Poke around in there. You will find all that you need.

[inovexsean]

I'll try, and I appreciate the info, but my terminal here (which is not my development box) is pretty locked-down.

[woodcock]

Just install Splunk on your local machine and check it out.