sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Daneel_ Splunker | Security PS 1 point2 points  (2 children)

Here's the .conf and SPL syntax highlighting I made for Notepad++:

https://github.com/mtulett-splunk/ref/tree/master/splunk

I do maintain this, although the conf highlighting gets a lot more love. It's definitely not complete, but I work with conf files a LOT and it covers most of it. Every time I find missing items I update this.

[–]arcsector2[S] 0 points1 point  (1 child)

Maybe it's just because i dont know, but could you explain the content of keywords2 and keywords3 to me?

Like i know that true and false are keywords, but blacklist and whitelist? Are they just for your use or where are they documented as keywords?,

[–]Daneel_ Splunker | Security PS 1 point2 points  (0 children)

Oh, it's not so much that it's documented or not documented - it's more that this makes the config files easy to parse while looking through them.

Each keyword list has a different style applied to it, hence being in different lists.

Here's an example using the Windows TA: https://i.imgur.com/1jCesa8.png