I have a system that receives data from other systems for auditing purposes. One of these systems uses Splunk and I have a need to parse the queries. I am hoping someone can point me to a grammar for the Splunk language (Antlr, BNF, etc.).
Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db
I generated these by running /opt/splunk/bin/splunk btool searchbnf list
on a fairly default Splunk 7.2 instance.
Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db
I generated these by running /opt/splunk/bin/splunk btool searchbnf list
on a fairly default Splunk 7.2 instance.
Thanks. This'll be a big help.
Install splunk and go to the /opt/splunk/etc/system/README/
directory. Poke around in there. You will find all that you need.
I'll try, and I appreciate the info, but my terminal here (which is not my development box) is pretty locked-down.
Just install Splunk on your local machine and check it out.