---

Ⅰ. 插件描述

Syntax file for Splunk Search Language

Ⅱ. 基本信息

创建日期：  2014-10-06 使用用户：  2 Github星：  3 插件作者：  The Happy Hacker

Ⅲ. 安装方法

使用Vundle管理器安装

在你的.vimrc下添加:

Plugin '/splunk-vim'

… 然后在Vim中运行以下命令:

:source %
:PluginInstall

对于Vundle版本 < 0.10.2，请用上面的Bundle替换Plugin。

使用NeoBundle管理器安装

在你的.vimrc下添加:

NeoBundle '/splunk-vim'

… 然后在Vim中运行以下命令:

:source %
:NeoBundleInstall

使用VimPlug管理器安装

在你的.vimrc下添加:

Plug '/splunk-vim'

… 然后在Vim中运行以下命令:

:source %
:PlugInstall

使用Pathogen管理器安装

在终端中运行以下命令:

cd ~/.vim/bundle
git clone https://github.com/vim-scripts/splunk.vim

Ⅳ. 文档说明

If you do allot of work writing Splunk queries (http://www.splunk.com) and you live in the online docs for the Splunk Search Reference (see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual) this might be helpful.

This does color syntax highlighting for the Splunk 6.1.4 Search Language.  It does not detect syntax errors.  It recognizes all the Splunk Commands, all the Splunk Functions (both the EVAL and WHERE command functions and the functions for STATS, TIMECHART, CHART, ...), and most of the keywords for the Splunk Commands.

There is no error checking, currently.  If you use a function for the EVAL command in your STATS command the function name will be highlighted like normal.  (Something for improvement: in the future the script will be smartened-up to recognize this and indicate it is an error.)

Relative Date/Time Modifiers are recognized and look the same as Strings and Numbers.  The Relative Date/Time Modifiers are recognized anywhere in the search.  That is a bug.  The relative date/time modifiers are only valid after the following keywords: 'earliest', 'latest', 'span'

The relative date/time modifier bug does slow down the whole thing a little.   This will be fixed in the next release.