Splunk Search

What kind of syntax is limit and span?

cotyp
Path Finder

I noticed that limit and span always turn green. What kind of component are they?

For instance: blue is used for commands and orange for clauses

Thanks in advanced!

Tags (1)
0 Karma

niketn
Legend

Syntax highlighting was introduced in version 6.5 and has been enhanced in 6.6 (theme and editing)

Syntax component                           Color    Example
Commands                                   Blue  ...timechart
Command arguments                         Green ...timechart usenull=false
Functions                                 Pink   ...timechart count
Keyword modifiers and Boolean operators Orange   ...timechart count BY productName

http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsingsearches#Color_codes

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

DalJeanis
Legend

Those are keyword parameters. max_match= in a rex, keepempty= in a dedup, and count= in makeresults should turn the same color.


Update: per niketnilay's post, splunk terminology appears to be argument.

Verify by checking |sort fieldA desc. If, as expected, desc turns green, then all arguments, not just keyword parameter arguments, are marked green.

jkat54
SplunkTrust
SplunkTrust

I agree. In the code behind the scenes (which you get into if you write your own custom spl commands) keywords are key value pairs (this=that) and options are non-key value pairs (I liken them to switches or arguments in command line).

So in this example

| rex mode=sed field=source "s/replacethis/withthis/g"

The keywords are mode=sed & field=source and the option is the sed command.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...