Class: Rouge::Lexers::SPL2

Inherits:
RegexLexer
  • Object
show all
Defined in:
lib/rouge/lexers/spl2.rb

Class Method Summary collapse

Class Method Details

.boolean_operators ⇒ Object

Boolean / logical operators. Splunk requires uppercase for these.



58
59
60
 
# File 'lib/rouge/lexers/spl2.rb', line 58

def self.boolean_operators
  @boolean_operators ||= Set.new %w(AND OR NOT XOR)
end

.commands ⇒ Object

SPL2 commands (verb-like operators that drive a pipeline). Sourced from the SPL2 command quick reference.



30
31
32
33
34
35
36
37
38
39
 
# File 'lib/rouge/lexers/spl2.rb', line 30

def self.commands
  @commands ||= Set.new %w(
    addinfo append appendcols appendpipe bin branch convert decrypt
    dedup eval eventstats expand fields fieldsummary fillnull flatten
    from head into iplocation join loadjob lookup makemv makeresults
    mstats mvcombine mvexpand nomv ocsf rename replace reverse rex route
    search select sort spath spl1 stats streamstats table tags thru
    timechart timewrap tstats typer union untable where
  )
end

.constants ⇒ Object

Boolean and null literals.



63
64
65
 
# File 'lib/rouge/lexers/spl2.rb', line 63

def self.constants
  @constants ||= Set.new %w(true false null)
end

.data_types ⇒ Object

Built-in data types (used in custom function signatures, type statements, and constrained types).



69
70
71
72
73
74
 
# File 'lib/rouge/lexers/spl2.rb', line 69

def self.data_types
  @data_types ||= Set.new %w(
    any array boolean dataset double float int log_span long mv
    number object regex relative_time string time time_span
  )
end

.detect?(text) ⇒ Boolean

Pipelines very often start with ‘| <command>` or use `from $source` and feature distinctive `_time`, `index=`, or `sourcetype=` clauses.

Returns:

  • (Boolean) 


15
16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/rouge/lexers/spl2.rb', line 15

def self.detect?(text)
  return true if text.shebang?('spl2')

  head = text.lines.first(50).join

  return true if head =~ /\|\s*(?:search|from|stats|eval|where|fields|table|rex|spath)\b/i
  return true if head =~ /\bfrom\s+\$source\b/i
  return true if head =~ /\b(?:index|sourcetype|source|host)\s*=/
  return true if head =~ /\b_time\s*[=<>]/

  false
end

.eval_functions ⇒ Object

Eval functions from the SPL2 eval functions quick reference.



77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
 
# File 'lib/rouge/lexers/spl2.rb', line 77

def self.eval_functions
  @eval_functions ||= Set.new %w(
    abs acos acosh all any asin asinh atan atan2 atanh batch_id
    batch_time case ceil ceiling cidrmatch cluster coalesce cos cosh
    exact exp filter floor hypot if in instance_id ipmask isarray
    isbool isdouble isint ismv isnotnull isnull isnum isobject isstr
    json json_append json_array json_array_to_mv json_delete
    json_entries json_extend json_extract json_extract_exact
    json_has_key_exact json_keys json_object json_set json_set_exact
    json_valid len like ln log lower ltrim map match max md5 min
    mv_to_json_array mvappend mvcount mvdedup mvfilter mvfind mvindex
    mvjoin mvrange mvsort mvzip now null nullif pi pow printf random
    reduce relative_time replace round rtrim searchmatch sha1 sha256
    sha512 sigfig sin sinh spath split sqrt strftime strptime substr
    time to_ocsf toarray tobool todouble toint tojson tomv tonumber
    toobject tostring trim typeof upper urldecode validate
  )
end

.keywords ⇒ Object

Clause/structural keywords used inside commands and statements.



42
43
44
45
46
47
48
49
 
# File 'lib/rouge/lexers/spl2.rb', line 42

def self.keywords
  @keywords ||= Set.new %w(
    AFTER APPLY AS ASC BEFORE BY DESC DISTINCT EXPORT FIT FUNCTION
    GROUP GROUPBY HAVING IMPORT INNER LEFT LIMIT OFFSET ON ONCHANGE
    ORDER ORDERBY OUTER OUTPUT OUTPUTNEW RESET RETURN THROUGH TYPE
    WHILE
  )
end

.magic_fields ⇒ Object

Built-in / magic field names referenced in the SPL2 search reference.



107
108
109
110
111
112
 
# File 'lib/rouge/lexers/spl2.rb', line 107

def self.magic_fields
  @magic_fields ||= Set.new %w(
    _time _raw _index _indextime _sourcetype _source _host _path
    _bkt _cd _kv _meta _serial _si _subsecond
  )
end

.stats_functions ⇒ Object

Stats / charting / aggregate / event-order functions.



97
98
99
100
101
102
103
104
 
# File 'lib/rouge/lexers/spl2.rb', line 97

def self.stats_functions
  @stats_functions ||= Set.new %w(
    avg count dataset distinct_count earliest earliest_time estdc
    estdc_error first last latest latest_time list max mean median min
    mode per_day per_hour per_minute per_second perc pivot range rate
    span sparkline stdev stdevp sum sumsq values var varp
  )
end

.word_operators ⇒ Object

Operator-style word keywords. Treated as operators rather than statement keywords because they participate in expressions.



53
54
55
 
# File 'lib/rouge/lexers/spl2.rb', line 53

def self.word_operators
  @word_operators ||= Set.new %w(BETWEEN EXISTS IN IS LIKE)
end