Splunk Search

Splunk Query Grammar

inovexsean
Explorer

I have a system that receives data from other systems for auditing purposes. One of these systems uses Splunk and I have a need to parse the queries. I am hoping someone can point me to a grammar for the Splunk language (Antlr, BNF, etc.).

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db

I generated these by running /opt/splunk/bin/splunk btool searchbnf list on a fairly default Splunk 7.2 instance.

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Here is the search BNF: https://gist.github.com/ChrisYounger/e51f9c3aba0f1ed02e5caee7d4a6128b
Datatypes BNF: https://gist.github.com/ChrisYounger/520bdb1a7c8b22f5210213f83a3ab2db

I generated these by running /opt/splunk/bin/splunk btool searchbnf list on a fairly default Splunk 7.2 instance.

0 Karma

inovexsean
Explorer

Thanks. This'll be a big help.

0 Karma

woodcock
Esteemed Legend

Install splunk and go to the /opt/splunk/etc/system/README/ directory. Poke around in there. You will find all that you need.

0 Karma

inovexsean
Explorer

I'll try, and I appreciate the info, but my terminal here (which is not my development box) is pretty locked-down.

0 Karma

woodcock
Esteemed Legend

Just install Splunk on your local machine and check it out.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...