Skip to main content Svelte Highlight v7.21.1

SPL (Splunk) language preview

1. A stats pipeline

search terms, the pipe operator, and stats by
horizon-dark
search index=web status>=500
| stats count by host
| eval error_rate = count / total
| where error_rate > 0.05 AND host != "test"
| sort - count
atom-one-dark
search index=web status>=500
| stats count by host
| eval error_rate = count / total
| where error_rate > 0.05 AND host != "test"
| sort - count
github-dark
search index=web status>=500
| stats count by host
| eval error_rate = count / total
| where error_rate > 0.05 AND host != "test"
| sort - count
dracula
search index=web status>=500
| stats count by host
| eval error_rate = count / total
| where error_rate > 0.05 AND host != "test"
| sort - count
nord
search index=web status>=500
| stats count by host
| eval error_rate = count / total
| where error_rate > 0.05 AND host != "test"
| sort - count
github
search index=web status>=500
| stats count by host
| eval error_rate = count / total
| where error_rate > 0.05 AND host != "test"
| sort - count

2. Field extraction with rex

rex, table, and boolean search terms
horizon-dark
search sourcetype=access_combined
| rex field=_raw "user=(?<user>\w+)"
| table host, user, status
| dedup user
atom-one-dark
search sourcetype=access_combined
| rex field=_raw "user=(?<user>\w+)"
| table host, user, status
| dedup user
github-dark
search sourcetype=access_combined
| rex field=_raw "user=(?<user>\w+)"
| table host, user, status
| dedup user
dracula
search sourcetype=access_combined
| rex field=_raw "user=(?<user>\w+)"
| table host, user, status
| dedup user
nord
search sourcetype=access_combined
| rex field=_raw "user=(?<user>\w+)"
| table host, user, status
| dedup user
github
search sourcetype=access_combined
| rex field=_raw "user=(?<user>\w+)"
| table host, user, status
| dedup user

3. Eval functions

coalesce, if, and string functions
horizon-dark
eval label = if(isnull(coalesce(name, alias)), "unknown", upper(name))
atom-one-dark
eval label = if(isnull(coalesce(name, alias)), "unknown", upper(name))
github-dark
eval label = if(isnull(coalesce(name, alias)), "unknown", upper(name))
dracula
eval label = if(isnull(coalesce(name, alias)), "unknown", upper(name))
nord
eval label = if(isnull(coalesce(name, alias)), "unknown", upper(name))
github
eval label = if(isnull(coalesce(name, alias)), "unknown", upper(name))