What kind of syntax is limit and span?

[cotyp]

I noticed that limit and span always turn green. What kind of component are they?

For instance: blue is used for commands and orange for clauses

Thanks in advanced!

[niketn]

Syntax highlighting was introduced in version 6.5 and has been enhanced in 6.6 (theme and editing)

Syntax component                           Color    Example
Commands                                   Blue  ...timechart
Command arguments                         Green ...timechart usenull=false
Functions                                 Pink   ...timechart count
Keyword modifiers and Boolean operators Orange   ...timechart count BY productName

http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsingsearches#Color_codes

[DalJeanis]

Those are keyword parameters. max_match= in a rex, keepempty= in a dedup, and count= in makeresults should turn the same color.

---

Update: per niketnilay's post, splunk terminology appears to be argument.

Verify by checking |sort fieldA desc. If, as expected, desc turns green, then all arguments, not just keyword parameter arguments, are marked green.

[jkat54]

I agree. In the code behind the scenes (which you get into if you write your own custom spl commands) keywords are key value pairs (this=that) and options are non-key value pairs (I liken them to switches or arguments in command line).

So in this example

| rex mode=sed field=source "s/replacethis/withthis/g"

The keywords are mode=sed & field=source and the option is the sed command.