search

salspaugh / splparser

Simple parser for Splunk Processing Language (SPL) written in Python.
Other
35 stars 14 forks source link

Typeahead #107

Closed keroro824 closed 10 years ago

keroro824 commented 10 years ago

typeahead prefix= count= [max_time=] [] [] [] [collapse]

For index=? here, because we have "index" in DEFAULT_FIELD, it will cause error if I add it to TYPEAHEAD_OPT. If I define a rule like DEFAULT_FIELD EQ value, the index one is still not working. How can I solve this problem?

salspaugh commented 10 years ago

You can define a separate regexes file that redefines the default field regex, and defines a special index token. Then you can define rules accordingly (allowing the index token to be both an option and a field).

keroro824 commented 10 years ago

I complete this one.

salspaugh commented 10 years ago

Ok, I'll review it in the morning.

salspaugh commented 10 years ago

After making those changes I mentioned, go ahead and merge. Don't forget to follow this procedure exactly!

salspaugh commented 10 years ago

Made one more comment. Fix that then you're good to merge.

salspaugh commented 10 years ago

=/

salspaugh commented 10 years ago

I guess just make that fix on another branch then...

keroro824 commented 10 years ago

.<

keroro824 commented 10 years ago

Sorry... But I have already changed that in outputcsv

keroro824 commented 10 years ago

I add end_of_token for all xx_opt. Is that ok?

salspaugh commented 10 years ago

Ok, no problem then. Just make sure all the tests still run (python run_tests.py -- some will fail due to known bugs that we aren't fixing right now).