Main repo for vscode splunk syntax highlighting
.spl
and .splunk
files.md
files using ```spl
to open the code block Install from source by downloading this repo and unzipping into your vscode extensions directory. The default directories are ususally,
~/.vscode/extensions
%USERPROFILE%\.vscode\extensions
Install directly in visual studio by going to the extensions tab and searching for "splunk search"
. The quotes are imperative as the words are normally not treated as a phrase. Click the Install
button on the extension with the same name as this README and you're good to go.
You can try and use the following JSON blob:
{
"editor.tokenColorCustomizations": {
"textMateRules": [
{
"scope": "constant.language.splunk_search",
"settings":{
"foreground": "#F58220"
}
},
{
"scope": "support.function.splunk_search",
"settings":{
"foreground": "#CF00CF"
}
},
{
"scope": "support.class.splunk_search",
"settings":{
"foreground": "#2662FD"
}
}
]
}
}
partitions=X
, partitions
should be highlighted in this instance only after the =
sign has been placeddbxquery
with query=
| eval info=if(isnull(info),"N/A",info)
, currently the third info
is not highlighted. This should be changed as the parameter is valid. The issue is that we need a recursive strategy for highlighting these params, but regular expressions don't have built-in recursive functionality. This may never happen