"splunk-spl": {

"title": "Splunk SPL",

"owner": "RunDevelopment"

},

"sql": {

"title": "SQL",

"owner": "multipetros"

},

Prism.languages['splunk-spl'] = {

'comment': /`comment\("(?:\\.|[^\\"])*"\)`/,

'string': {

pattern: /"(?:\\.|[^\\"])*"/,

greedy: true

},

// https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/ListOfSearchCommands

'keyword': /\b(?:abstract|accum|addcoltotals|addinfo|addtotals|analyzefields|anomalies|anomalousvalue|anomalydetection|append|appendcols|appendcsv|appendlookup|appendpipe|arules|associate|audit|autoregress|bin|bucket|bucketdir|chart|cluster|cofilter|collect|concurrency|contingency|convert|correlate|datamodel|dbinspect|dedup|delete|delta|diff|erex|eval|eventcount|eventstats|extract|fieldformat|fields|fieldsummary|filldown|fillnull|findtypes|folderize|foreach|format|from|gauge|gentimes|geom|geomfilter|geostats|head|highlight|history|iconify|input|inputcsv|inputlookup|iplocation|join|kmeans|kv|kvform|loadjob|localize|localop|lookup|makecontinuous|makemv|makeresults|map|mcollect|metadata|metasearch|meventcollect|mstats|multikv|multisearch|mvcombine|mvexpand|nomv|outlier|outputcsv|outputlookup|outputtext|overlap|pivot|predict|rangemap|rare|regex|relevancy|reltime|rename|replace|rest|return|reverse|rex|rtorder|run|savedsearch|script|scrub|search|searchtxn|selfjoin|sendemail|set|setfields|sichart|sirare|sistats|sitimechart|sitop|sort|spath|stats|strcat|streamstats|table|tags|tail|timechart|timewrap|top|transaction|transpose|trendline|tscollect|tstats|typeahead|typelearner|typer|union|uniq|untable|where|x11|xmlkv|xmlunescape|xpath|xyseries)\b/i,

'operator-word': {

pattern: /\b(?:and|as|by|not|or|xor)\b/i,

alias: 'operator'

},

'function': /\w+(?=\s*\()/,

'property': /\w+(?=\s*=(?!=))/,

'date': {

// MM/DD/YYYY(:HH:MM:SS)?

pattern: /\b\d{1,2}\/\d{1,2}\/\d{1,4}(?:(?::\d{1,2}){3})?\b/,

alias: 'number'

},

'number': /\b\d+(?:\.\d+)?\b/,

'boolean': /\b(?:f|false|t|true)\b/i,

'operator': /[<>=]=?|[-+*/%|]/,

'punctuation': /[()[\],]/

<h2>Full example</h2>

<pre><code>source=monthly_data.csv

| rename remote_ip AS ip

| eval isLocal=if(cidrmatch("123.132.32.0/25",ip), "local", "not local")

| eval error=case(status == 200, "OK", status == 404, "Not found", true(), "Other")

`comment("TODO: Add support for more status codes")`

| sort amount</code></pre>

"splunk-spl": "Splunk SPL",

"sql": "SQL",

`comment("This is a comment")`

`comment("This is too

but on more than one line")`

`comment("| stats sum(b) BY index")`

----------------------------------------------------

[

["comment", "`comment(\"This is a comment\")`"],

["comment", "`comment(\"This is too\r\nbut on more than one line\")`"],

["comment", "`comment(\"| stats sum(b) BY index\")`"]

]

----------------------------------------------------

Checks for comments.

1/1/1970

12/31/1999:23:59:59

----------------------------------------------------

[

["date", "1/1/1970"],

["date", "12/31/1999:23:59:59"]

]

----------------------------------------------------

Checks for dates.