I noticed that limit and span always turn green. What kind of component are they?
For instance: blue is used for commands and orange for clauses
Thanks in advanced!
Syntax highlighting was introduced in version 6.5 and has been enhanced in 6.6 (theme and editing)
Syntax component Color Example
Commands Blue ...timechart
Command arguments Green ...timechart usenull=false
Functions Pink ...timechart count
Keyword modifiers and Boolean operators Orange ...timechart count BY productName
http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsingsearches#Color_codes
Those are keyword parameters. max_match=
in a rex
, keepempty=
in a dedup
, and count=
in makeresults
should turn the same color.
Update: per niketnilay's post, splunk terminology appears to be argument.
Verify by checking |sort fieldA desc
. If, as expected, desc
turns green, then all arguments, not just keyword parameter arguments, are marked green.
I agree. In the code behind the scenes (which you get into if you write your own custom spl commands) keywords are key value pairs (this=that) and options are non-key value pairs (I liken them to switches or arguments in command line).
So in this example
| rex mode=sed field=source "s/replacethis/withthis/g"
The keywords are mode=sed & field=source and the option is the sed command.