What kind of syntax is limit and span?

Path Finder

I noticed that limit and span always turn green. What kind of component are they?

For instance: blue is used for commands and orange for clauses

Thanks in advanced!

Tags (1)
0 Karma


Syntax highlighting was introduced in version 6.5 and has been enhanced in 6.6 (theme and editing)

Syntax component                           Color    Example
Commands                                   Blue  ...timechart
Command arguments                         Green ...timechart usenull=false
Functions                                 Pink   ...timechart count
Keyword modifiers and Boolean operators Orange   ...timechart count BY productName

| makeresults | eval message= "Happy Splunking!!!"


Those are keyword parameters. max_match= in a rex, keepempty= in a dedup, and count= in makeresults should turn the same color.

Update: per niketnilay's post, splunk terminology appears to be argument.

Verify by checking |sort fieldA desc. If, as expected, desc turns green, then all arguments, not just keyword parameter arguments, are marked green.


I agree. In the code behind the scenes (which you get into if you write your own custom spl commands) keywords are key value pairs (this=that) and options are non-key value pairs (I liken them to switches or arguments in command line).

So in this example

| rex mode=sed field=source "s/replacethis/withthis/g"

The keywords are mode=sed & field=source and the option is the sed command.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!