splunk_search.tmLanguage

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>fileTypes</key>
    <array>
      <string>splunk</string>
      <string>spl</string>
    </array>
    <key>name</key>
    <string>Splunk Query Language</string>
    <key>patterns</key>
    <array>
      <dict>
        <key>comment</key>
        <string>Splunk Built-in functions</string>
        <key>match</key>
        <string>(?&lt;=(\||\[))([\s]*)\b(abstract|accum|addcoltotals|addinfo|addtotals|analyzefields|anomalies|anomalousvalue|append|appendcols|appendpipe|arules|associate|audit|autoregress|bucket|bucketdir|chart|cluster|collect|concurrency|contingency|convert|correlate|crawl|datamodel|dbinspect|dbxquery|dbxlookup|dedup|delete|delta|diff|dispatch|erex|eval|eventcount|eventstats|extract|fieldformat|fields|fieldsummary|file|filldown|fillnull|findtypes|folderize|foreach|format|from|gauge|gentimes|geostats|head|highlight|history|input|inputcsv|inputlookup|iplocation|join|kmeans|kvform|loadjob|localize|localop|lookup|makecontinuous|makemv|makeresults|map|metadata|metasearch|multikv|multisearch|mvcombine|mvexpand|nomv|outlier|outputcsv|outputlookup|outputtext|overlap|pivot|predict|rangemap|rare|regex|relevancy|reltime|rename|replace|rest|return|reverse|rex|rtorder|run|savedsearch|script|scrub|search|searchtxn|selfjoin|sendemail|set|setfields|sichart|sirare|sistats|sitimechart|sitop|sort|spath|stats|strcat|streamstats|table|tags|tail|timechart|top|transaction|transpose|trendline|tscollect|tstats|typeahead|typelearner|typer|uniq|untable|where|x11|xmlkv|xmlunescape|xpath|xyseries)\b(?=[\s])</string>
        <key>name</key>
        <string>support.class.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Splunk Eval functions</string>
        <key>match</key>
        <string>\b(abs|acos|acosh|asin|asinh|atan|atan2|atanh|case|cidrmatch|ceiling|coalesce|commands|cos|cosh|exact|exp|floor|hypot|if|in|isbool|isint|isnotnull|isnull|isnum|isstr|len|like|ln|log|lower|ltrim|match|max|md5|min|mvappend|mvcount|mvdedup|mvfilter|mvfind|mvindex|mvjoin|mvrange|mvsort|mvzip|now|null|nullif|pi|pow|printf|random|relative_time|replace|round|rtrim|searchmatch|sha1|sha256|sha512|sigfig|sin|sinh|spath|split|sqrt|strftime|strptime|substr|tan|tanh|time|tonumber|tostring|trim|typeof|upper|urldecode|validate)(?=\()\b</string>
        <key>name</key>
        <string>support.function.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Splunk Transforming functions</string>
        <key>match</key>
        <string>\b(avg|count|distinct_count|estdc|estdc_error|eval|max|mean|median|min|mode|percentile|range|stdev|stdevp|sum|sumsq|var|varp|first|last|list|values|earliest|earliest_time|latest|latest_time|per_day|per_hour|per_minute|per_second|rate)\b</string>
        <key>name</key>
        <string>support.function.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Splunk Macro Names</string>
        <key>match</key>
        <string>(?&lt;=\`)[\w]+(?=\(|\`)</string>
        <key>name</key>
        <string>entity.name.function.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Digits</string>
        <key>match</key>
        <string>\b(\d+)\b</string>
        <key>name</key>
        <string>constant.numeric.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Escape Characters</string>
        <key>match</key>
        <string>(\\\\|\\\||\\\*|\\\=)</string>
        <key>name</key>
        <string>contant.character.escape.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Splunk Operators</string>
        <key>match</key>
        <string>(\|,)</string>
        <key>name</key>
        <string>keyword.operator.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Splunk Language Constants</string>
        <key>match</key>
        <string>(?i)\b(as|by|or|and|over|where|output|outputnew)\b|(?-i)\b(NOT|true|false)\b</string>
        <key>name</key>
        <string>constant.language.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Splunk Macro Parameters</string>
        <key>match</key>
        <string>(?&lt;=\(|,|[^=]\s{300})([^\(\)\",=]+)(?=\)|,)</string>
        <key>name</key>
        <string>variable.parameter.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Splunk Variables</string>
        <key>match</key>
        <string>([\w\.]+)(\[\]|\{\})?([\s]*)(?=\=)</string>
        <key>name</key>
        <string>variable.splunk_search</string>
      </dict>
      <dict>
        <key>comment</key>
        <string>Comparison or assignment</string>
        <key>match</key>
        <string>=</string>
        <key>name</key>
        <string>keyword.operator.splunk_search</string>
      </dict>
      <dict>
        <key>begin</key>
        <string>(?&lt;!\\)"</string>
        <key>end</key>
        <string>(?&lt;!\\)"</string>
        <key>name</key>
        <string>string.quoted.double.splunk_search</string>
      </dict>
      <dict>
        <key>begin</key>
        <string>(?&lt;!\\)'</string>
        <key>end</key>
        <string>(?&lt;!\\)'</string>
        <key>name</key>
        <string>string.quoted.single.splunk_search</string>
      </dict>
      <dict>
        <key>begin</key>
        <string>query=\"</string>
        <key>end</key>
        <string>(?&lt;!\\)"</string>
        <key>name</key>
        <string>meta.embedded.block.sql</string>
      </dict>
      <dict>
        <key>begin</key>
        <string>(?&lt;!\\)```</string>
        <key>end</key>
        <string>(?&lt;!\\)```</string>
        <key>name</key>
        <string>comment.block.splunk_search</string>
      </dict>
      <dict>
        <key>begin</key>
        <string>`comment\(</string>
        <key>end</key>
        <string>\)`</string>
        <key>name</key>
        <string>comment.block.splunk_search</string>
      </dict>
    </array>
    <key>scopeName</key>
    <string>source.splunk_search</string>
  </dict>
</plist>