Archive

What kind of syntax is limit and span?

cotyp
Path Finder

I noticed that limit and span always turn green. What kind of component are they?

For instance: blue is used for commands and orange for clauses

Thanks in advanced!

Tags (1)
0 Karma

niketnilay
Legend

Syntax highlighting was introduced in version 6.5 and has been enhanced in 6.6 (theme and editing)

Syntax component                           Color    Example
Commands                                   Blue  ...timechart
Command arguments                         Green ...timechart usenull=false
Functions                                 Pink   ...timechart count
Keyword modifiers and Boolean operators Orange   ...timechart count BY productName

http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsingsearches#Color_codes

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

DalJeanis
SplunkTrust
SplunkTrust

Those are keyword parameters. max_match= in a rex, keepempty= in a dedup, and count= in makeresults should turn the same color.


Update: per niketnilay's post, splunk terminology appears to be argument.

Verify by checking |sort fieldA desc. If, as expected, desc turns green, then all arguments, not just keyword parameter arguments, are marked green.

jkat54
SplunkTrust
SplunkTrust

I agree. In the code behind the scenes (which you get into if you write your own custom spl commands) keywords are key value pairs (this=that) and options are non-key value pairs (I liken them to switches or arguments in command line).

So in this example

| rex mode=sed field=source "s/replacethis/withthis/g"

The keywords are mode=sed & field=source and the option is the sed command.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!