| 1 |
{ |
| 2 |
"fileTypes": ["splunk", "spl"], |
| 3 |
"name": "splunk", |
| 4 |
"patterns": [ |
| 5 |
{ |
| 6 |
"comment": "Splunk Built-in functions", |
| 7 |
"match": "(?<=(\\||\\[))([\\s]*)\\b(abstract|accum|addcoltotals|addinfo|addtotals|analyzefields|anomalies|anomalousvalue|append|appendcols|appendpipe|arules|associate|audit|autoregress|bucket|bucketdir|chart|cluster|collect|concurrency|contingency|convert|correlate|crawl|datamodel|dbinspect|dbxquery|dbxlookup|dedup|delete|delta|diff|dispatch|erex|eval|eventcount|eventstats|extract|fieldformat|fields|fieldsummary|file|filldown|fillnull|findtypes|folderize|foreach|format|from|gauge|gentimes|geostats|head|highlight|history|input|inputcsv|inputlookup|iplocation|join|kmeans|kvform|loadjob|localize|localop|lookup|makecontinuous|makemv|makeresults|map|metadata|metasearch|multikv|multisearch|mvcombine|mvexpand|nomv|outlier|outputcsv|outputlookup|outputtext|overlap|pivot|predict|rangemap|rare|regex|relevancy|reltime|rename|replace|rest|return|reverse|rex|rtorder|run|savedsearch|script|scrub|search|searchtxn|selfjoin|sendemail|set|setfields|sichart|sirare|sistats|sitimechart|sitop|sort|spath|stats|strcat|streamstats|table|tags|tail|timechart|top|transaction|transpose|trendline|tscollect|tstats|typeahead|typelearner|typer|uniq|untable|where|x11|xmlkv|xmlunescape|xpath|xyseries)\\b(?=[\\s])", |
| 8 |
"name": "support.class.splunk_search" |
| 9 |
}, |
| 10 |
{ |
| 11 |
"comment": "Splunk Eval functions", |
| 12 |
"match": "\\b(abs|acos|acosh|asin|asinh|atan|atan2|atanh|case|cidrmatch|ceiling|coalesce|commands|cos|cosh|exact|exp|floor|hypot|if|in|isbool|isint|isnotnull|isnull|isnum|isstr|len|like|ln|log|lower|ltrim|match|max|md5|min|mvappend|mvcount|mvdedup|mvfilter|mvfind|mvindex|mvjoin|mvrange|mvsort|mvzip|now|null|nullif|pi|pow|printf|random|relative_time|replace|round|rtrim|searchmatch|sha1|sha256|sha512|sigfig|sin|sinh|spath|split|sqrt|strftime|strptime|substr|tan|tanh|time|tonumber|tostring|trim|typeof|upper|urldecode|validate)(?=\\()\\b", |
| 13 |
"name": "support.function.splunk_search" |
| 14 |
}, |
| 15 |
{ |
| 16 |
"comment": "Splunk Transforming functions", |
| 17 |
"match": "\\b(avg|count|distinct_count|estdc|estdc_error|eval|max|mean|median|min|mode|percentile|range|stdev|stdevp|sum|sumsq|var|varp|first|last|list|values|earliest|earliest_time|latest|latest_time|per_day|per_hour|per_minute|per_second|rate)\\b", |
| 18 |
"name": "support.function.splunk_search" |
| 19 |
}, |
| 20 |
{ |
| 21 |
"comment": "Splunk Macro Names", |
| 22 |
"match": "(?<=\\`)[\\w]+(?=\\(|\\`)", |
| 23 |
"name": "entity.name.function.splunk_search" |
| 24 |
}, |
| 25 |
{ |
| 26 |
"comment": "Digits", |
| 27 |
"match": "\\b(\\d+)\\b", |
| 28 |
"name": "constant.numeric.splunk_search" |
| 29 |
}, |
| 30 |
{ |
| 31 |
"comment": "Escape Characters", |
| 32 |
"match": "(\\\\\\\\|\\\\\\||\\\\\\*|\\\\\\=)", |
| 33 |
"name": "contant.character.escape.splunk_search" |
| 34 |
}, |
| 35 |
{ |
| 36 |
"comment": "Splunk Operators", |
| 37 |
"match": "(\\|,)", |
| 38 |
"name": "keyword.operator.splunk_search" |
| 39 |
}, |
| 40 |
{ |
| 41 |
"comment": "Splunk Language Constants", |
| 42 |
"match": "(?i)\\b(as|by|or|and|over|where|output|outputnew)\\b|(?-i)\\b(NOT|true|false)\\b", |
| 43 |
"name": "constant.language.splunk_search" |
| 44 |
}, |
| 45 |
{ |
| 46 |
"comment": "Splunk Macro Parameters", |
| 47 |
"match": "(?<=\\(|,|[^=]\\s{300})([^\\(\\)\\\",=]+)(?=\\)|,)", |
| 48 |
"name": "variable.parameter.splunk_search" |
| 49 |
}, |
| 50 |
{ |
| 51 |
"comment": "Splunk Variables", |
| 52 |
"match": "([\\w\\.]+)(\\[\\]|\\{\\})?([\\s]*)(?=\\=)", |
| 53 |
"name": "variable.splunk_search" |
| 54 |
}, |
| 55 |
{ |
| 56 |
"comment": "Comparison or assignment", |
| 57 |
"match": "=", |
| 58 |
"name": "keyword.operator.splunk_search" |
| 59 |
}, |
| 60 |
{ |
| 61 |
"begin": "(?<!\\\\)\"", |
| 62 |
"end": "(?<!\\\\)\"", |
| 63 |
"name": "string.quoted.double.splunk_search" |
| 64 |
}, |
| 65 |
{ |
| 66 |
"begin": "(?<!\\\\)'", |
| 67 |
"end": "(?<!\\\\)'", |
| 68 |
"name": "string.quoted.single.splunk_search" |
| 69 |
}, |
| 70 |
{ |
| 71 |
"begin": "query=\\\"", |
| 72 |
"end": "(?<!\\\\)\"", |
| 73 |
"name": "meta.embedded.block.sql" |
| 74 |
}, |
| 75 |
{ |
| 76 |
"begin": "(?<!\\\\)```", |
| 77 |
"end": "(?<!\\\\)```", |
| 78 |
"name": "comment.block.splunk_search" |
| 79 |
}, |
| 80 |
{ |
| 81 |
"begin": "`comment\\(", |
| 82 |
"end": "\\)`", |
| 83 |
"name": "comment.block.splunk_search" |
| 84 |
} |
| 85 |
], |
| 86 |
"scopeName": "source.splunk_search" |
| 87 |
} |
| 88 |
|
