-
Notifications
You must be signed in to change notification settings - Fork 3
/
splunk.tmLanguage
90 lines (90 loc) · 3.16 KB
/
splunk.tmLanguage
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>fileTypes</key>
<array>
<string>splunk</string>
<string>spl</string>
</array>
<key>name</key>
<string>Splunk Query Language</string>
<key>patterns</key>
<array>
<dict>
<key>comment</key>
<string>Splunk Built-in function</string>
<key>match</key>
<string>\b(abstract|accum|addcoltotals|addinfo|addtotals|analyzefields|anomalies|anomalousvalue|append|appendcols|appendpipe|arules|associate|audit|autoregress|bucket|bucketdir|chart|cluster|collect|concurrency|contingency|convert|correlate|crawl|datamodel|dbinspect|dedup|delete|delta|diff|dispatch|erex|eval|eventcount|eventstats|extract|fieldformat|fields|fieldsummary|file|filldown|fillnull|findtypes|folderize|foreach|format|gauge|gentimes|geostats|head|highlight|history|input|inputcsv|inputlookup|iplocation|join|kmeans|kvform|loadjob|localize|localop|lookup|makecontinuous|makemv|map|metadata|metasearch|multikv|multisearch|mvcombine|mvexpand|nomv|outlier|outputcsv|outputlookup|outputtext|overlap|pivot|predict|rangemap|rare|regex|relevancy|reltime|rename|replace|rest|return|reverse|rex|rtorder|run|savedsearch|script|scrub|search|searchtxn|selfjoin|sendemail|set|setfields|sichart|sirare|sistats|sitimechart|sitop|sort|spath|stats|strcat|streamstats|table|tags|tail|timechart|top|transaction|transpose|trendline|tscollect|tstats|typeahead|typelearner|typer|uniq|untable|where|x11|xmlkv|xmlunescape|xpath|xyseries)\b</string>
<key>name</key>
<string>support.class.splunk</string>
</dict>
<dict>
<key>captures</key>
<dict>
<key>1</key>
<dict>
<key>name</key>
<string>support.class.splunk</string>
</dict>
</dict>
<key>comment</key>
<string>Function calls</string>
<key>match</key>
<string>([A-Za-z0-9]+) *\(</string>
</dict>
<dict>
<key>comment</key>
<string>Digits</string>
<key>match</key>
<string>\b(\d+)\b</string>
<key>name</key>
<string>constant.numeric.splunk</string>
</dict>
<dict>
<key>comment</key>
<string>Splunk Pipe</string>
<key>match</key>
<string>\|</string>
<key>name</key>
<string>constant.language.splunk</string>
</dict>
<dict>
<key>comment</key>
<string>Splunk Operators</string>
<key>match</key>
<string>\b(AND|OR|as|AS|by|BY)\b</string>
<key>name</key>
<string>keyword.operator.splunk</string>
</dict>
<dict>
<key>comment</key>
<string>Comparison or assignment</string>
<key>match</key>
<string>=</string>
<key>name</key>
<string>keyword.operator.splunk</string>
</dict>
<dict>
<key>begin</key>
<string>(?<!\\)"</string>
<key>end</key>
<string>(?<!\\)"</string>
<key>name</key>
<string>string.quoted.double.splunk</string>
</dict>
<dict>
<key>begin</key>
<string>(?<!\\)'</string>
<key>end</key>
<string>(?<!\\)'</string>
<key>name</key>
<string>string.quoted.single.splunk</string>
</dict>
</array>
<key>scopeName</key>
<string>source.splunk</string>
<key>uuid</key>
<string>8fbbb1e7-8311-4bdc-aaef-a1639ca8d0ad</string>
</dict>
</plist>