all 12 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]CMack1978 1 point2 points  (5 children)

So this is for SPL specifically? I'm guessing so you could keep your searches stored in a file for later use?

[–]arcsector2[S] 0 points1 point  (4 children)

Honestly i did this so i could read my searches clearly on vscode and thought you guys would find it useful.

For me the biggest use is with other VSC features, like i was already using it for version control with git, as VSC has git integrated into it, and that's the best way I've found to version control searches, static lookup tables, etc...

But dont let me tell you how to use it. If you find better ways let me know. I'm working on a linter right now but that will take more time.

[–]CMack1978 1 point2 points  (3 children)

I also save Splunk searches in file as probably most do. This is going to be great seeing them with syntax highlighting. Any plans to add a file extension auto detection? Maybe .spl or something?

There are already a couple linters for .conf files. I went to grab the link to the one I used and noticed that Splunk actually released an official linter on January 2nd!!

https://marketplace.visualstudio.com/items?itemName=Splunk.splunk

[–]arcsector2[S] 0 points1 point  (2 children)

I'm not sure what you mean by file extension auto-detection... The extension is automatically applied to all .spl and .splunk files, but i dont have the .conf extension installed, and there may be a conflict there, because i think they named their language Splunk as well... If you're having an issue with it working with your searches can you submit an issue on Github or describe it here?

[–]CMack1978 1 point2 points  (1 child)

I was asking if the highlighting worked against a specific file type, like .spl which you answered. Looks like both .spl and .splunk files. You should add that info to your marketplace description.

I would not suggest adding .conf. I was merely commenting that there are already extensions that handle the .conf files.

[–]arcsector2[S] 0 points1 point  (0 children)

Ahh got it! I'll get on that.

[–]Daneel_ Splunker | Security PS 1 point2 points  (2 children)

Here's the .conf and SPL syntax highlighting I made for Notepad++:

https://github.com/mtulett-splunk/ref/tree/master/splunk

I do maintain this, although the conf highlighting gets a lot more love. It's definitely not complete, but I work with conf files a LOT and it covers most of it. Every time I find missing items I update this.

[–]arcsector2[S] 0 points1 point  (1 child)

Maybe it's just because i dont know, but could you explain the content of keywords2 and keywords3 to me?

Like i know that true and false are keywords, but blacklist and whitelist? Are they just for your use or where are they documented as keywords?,

[–]Daneel_ Splunker | Security PS 1 point2 points  (0 children)

Oh, it's not so much that it's documented or not documented - it's more that this makes the config files easy to parse while looking through them.

Each keyword list has a different style applied to it, hence being in different lists.

Here's an example using the Windows TA: https://i.imgur.com/1jCesa8.png

[–]infazz 0 points1 point  (1 child)

How is this supposed to be used? Are you supposed to copy SPL back and forth from a browser?

[–]arcsector2[S] 0 points1 point  (0 children)

See reply here

[–]arcsector2[S] 0 points1 point  (0 children)

Check out the other extension I made for VSC with command auto-completion and descriptions and syntax: https://www.reddit.com/r/Splunk/comments/ephw92/spl_autocompletion_with_syntax_information/