Syntax highlighting

With syntax highlighting the SPL commands, arguments, functions, and keywords are color-coded to make it easier to read a search.

Consider the following search. 

sourcetype=access_* | timechart count(eval(action=purchase)) BY productName usenull=false useother=false

Syntax highlighting can make searches easier to read. Syntax highlighting shows commands, arguments, functions, and keywords in different colors. The following image shows a search string with syntax highlighting.

This screen image shows a search in the Search bar with syntax highlighting turned on. The commands, arguments, functions, and keywords are in different colors.

Syntax validation

If a command, argument, function, or boolean operator is not spelled or capitalized correctly, the term is not highlighted in color. The lack of color alerts you to incorrect syntax.

If you specify an incorrect data type for an argument, the data type appears in red. For example, the limit argument for the top command expects an integer. If you type ...|top limit=false the term false is highlighted in red because it is not an integer.

Turn off syntax highlighting

You can turn syntax highlighting colors off by turning off the advanced editor. This is useful for people who have difficulty distinguishing between different colors.

However, be aware that when the advanced editor is turned off, the color themes, auto-formatting, and line numbering features are not available.

Note: You cannot turn off or change syntax highlighting if you have a Splunk Free license. See About Splunk Free in the Admin manual.
  1. On the Splunk bar, select [User_account_name] > Preferences.

    This screen image shows the Splunk bar. The user account name "Administrator" is selected. The menu choices are Account Settings, Preferences, and Logout.

  2. Click SPL Editor.
  3. Turn off Advanced editor.

    This screen image shows the Preferences window with the SPL Editor preferences selected. The Advanced editor toggle switch is in the off position.

  4. Click Apply.