search

salspaugh / splparser

Simple parser for Splunk Processing Language (SPL) written in Python.
Other
35 stars 14 forks source link

fix the weird thing in Rare #75

Closed keroro824 closed 11 years ago

salspaugh commented 11 years ago

Looks good to merge after adding the last test.

salspaugh commented 11 years ago

Actually there is also a few of these types of commands in the data set:

rare 15 RiskName

I know that according to the documentation, this is not a valid command, but could you still make a parse rule for it? You should interpret the INT here as a limit and make the parse tree accordingly (i.e., have a LIMIT node with an INT node coming off of it).