Splunk Search

Splunk Query Grammar

inovexsean
Explorer

I have a system that receives data from other systems for auditing purposes. One of these systems uses Splunk and I have a need to parse the queries. I am hoping someone can point me to a grammar for the Splunk language (Antlr, BNF, etc.).

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db

I generated these by running /opt/splunk/bin/splunk btool searchbnf list on a fairly default Splunk 7.2 instance.

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db

I generated these by running /opt/splunk/bin/splunk btool searchbnf list on a fairly default Splunk 7.2 instance.

0 Karma

inovexsean
Explorer

Thanks. This'll be a big help.

0 Karma

woodcock
Esteemed Legend

Install splunk and go to the /opt/splunk/etc/system/README/ directory. Poke around in there. You will find all that you need.

0 Karma

inovexsean
Explorer

I'll try, and I appreciate the info, but my terminal here (which is not my development box) is pretty locked-down.

0 Karma

woodcock
Esteemed Legend

Just install Splunk on your local machine and check it out.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...