Include a hyphen and a definite article. The plural form is "add-ons". You can write it as "the add-on" after the first instance of the full name of the add-on. Use "add-on" when writing about a Technical Add-on, Supported Add-on, or Domain Add-on in Splunk docs. See add-on in the Splexicon.

Do this	Don't do this
add-on the add-on the Splunk Add-on for [name of third-party vendor]	add-On Add-On addon AddOn

For the most part, use "admin" as an adjective to identify the role-based access control label and "administrator" as a noun to identify a user's job title or responsibility. Don't capitalize.

Do this	Don't do this
You must be assigned the admin role to add members. As a Splunk administrator, you must onboard new members in your team.	You must be an admin to add members. You must be a Splunk Admin to onboard new members in your team.

Use to denote a chronological sequence of events that doesn't rely on cause and effect. Don't use to mean "when".

Do this	Don't do this
After you install the update, save your changes.	After a user logs in to your organization, a SessionLog event is created.

Don't include a hyphen.

Do this	Don't do this
antivirus	anti-virus

Don't include a hyphen.

Do this	Don't do this
autodiscover autoscale	auto-discover auto discover auto-scale

Put the variable name for a directory in all capital letters regardless of the operating system. If the variable name has spaces, replace the spaces with the underscore ( _ ) character.

For *nix, precede the base directory with a dollar sign ( $ ). For Windows, surround the base directory with percent signs ( % ).

Don't use. Use "deny list" as a noun and "deny" as a verb. There are additional synonyms you can use in specific situations:

• "Deny" refers to access

• "Reject" refers to validity

• "Exclude" refers to inclusion

For IP traffic, for example, "deny" is suitable. For files or rules, "exclude" might be more specific.

Do this	Don't do this
Deny the incoming data. Set up a deny list to exclude specific incoming data.	Blacklist the specific incoming data. Set up a blacklist to exclude specific incoming data.

Use as 2 words when used as a noun. Include a hyphen when used as an adjective.

Do this	Don't do this
from the command line command-line interface command-line tool	from the command-line command line interface command line tool

Use lowercase letters with a period in front or spell out "configuration file". See configuration file in the Splexicon.

Do this	Don't do this
.conf file configuration file	conf file CONF file

Don't use. Use "can" or write the sentence in the imperative mood. Avoid subjunctive mood.

Do this	Don't do this
Start by setting up a new stanza in the transforms.conf file.	You could start by setting up a new stanza in transforms.conf.

Use lowercase letters when writing generally about the color contrast choice that a user can select for their UI. Don't use "dark mode". Follow the capitalization used in the UI.

Do this	Don't do this
You can choose to view Splunk Web in a light theme or a dark theme. In the SPL Editor, select Themes, and then Light Theme or Dark Theme.	You can view Splunk Web in a Dark Theme. View Splunk Web in dark mode.

Use as a singular mass noun. Write "data is" rather than "data are", and use "less data" rather than "fewer data". Don't use "datum".

Do this	Don't do this
Data transfer is complete. The data includes weblogs, call center logs, and order system logs. Set this parameter if you want to backfill less data than the retention period.	The data aren't visible. The summary page has fewer data than the source index. The datum includes syslogs.

Use to mean the process of setting up the components for a partial or entire system, which can include installing and configuring software and hardware. Use "install" to mean installing a piece of software.

Do this	Don't do this
Deploy a multisite indexer cluster. You can deploy forwarders in a wide variety of scenarios.	Deploy the Splunk Enterprise .tgz file. You can deploy the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.

Don't use. Use "want" instead.

Do this	Don't do this
Edit the stanzas to collect the data you want to view.	Edit the stanzas to collect the data you desire.

Use as 2 words without "ue" when referring to the UI control. Use with the "ue" when referring to a conversation.

Do this	Don't do this
In the dialog box	In the dialog In the dialogue In the dialogue box

Use when discussing file system structures in a CLI context or when addressing developers who work with file structures programmatically. For CLI contexts, don't use "folder", which is typically used in GUI contexts.

Do this	Don't do this
Use the ./splunk add command and specify a directory for data ingestion to configure network inputs.	Use the ./splunk add command and specify a folder for data ingestion to configure network inputs.

Note: If you need to discuss both CLI and GUI options, use language that ensures users understand the terminology interchangeably.

Don't use to show the counteraction of turning off a feature, deactivating a feature, or describing a deactivated feature.

Choose a logical plain-language alternative that explains the action or state, such as "activate", "activated", "activates", "select", "selected", "selects", "show", "shows", "turn on", "turned on", "turns on", or the like.

Use as a verb to refer to inputting text. Don't use "specify". Don't use "type" because there are multiple ways to enter text.

Do this	Don't do this
Enter your name. Enter a password value. Enter your search in the search bar.	Type your name. Type a password value. Type your search in the search bar.

Use to refer to a named Experience such as Victoria Experience or Classic Experience. Always capitalize. Don't include a definite article. Use with the preposition "on" when describing how to use an Experience or its components.

Do this	Don't do this
Experience capabilities differ depending on your Experience designation. This feature is supported on Victoria Experience. In the About panel, find your Experience: Classic or Victoria.	The Experience capabilities differ depending on the Experience designation. This feature is supported in Victoria Experience. Navigate to the About panel to determine your experience.

A piece of code shipped with a product that provides a tool a user can use to complete a task or action. Generally, this term is best used in release notes to describe updates to a product release. Avoid documenting features and instead put the emphasis on how a user can achieve their goal.

Don't use to refer to the capabilities or functionality of a product.

Do this	Don't do this
Version 5.1.0 of the add-on contains the following new features.	Version 5.1.0 of the add-on contains the following new capabilities.

Include a hyphen between "field" and "value" when they modify the word "pair".

Do this	Don't do this
field-value pair	field/value pair field value pair

The suffix appended to a specific file. Put in lowercase letters.

Do this	Don't do this
Update the stanza in indexes.conf. Upload the upload.json file. Enlarge the workflow.jpg image. Create a file named tar-exmpl-2023.tar. The manual downloads as alert_actions.pdf. Distribute the file that ends in .splunkconfig.	Update the stanza in the conf file. Upload the Upload json file. Enlarge the workflow .jpg. Create a compressed .tgz archive file. The manual downloads as alert_actions.PDF. Send the fat_cats.GIF to the entire team.

A path that describes a location in a file system structure. Use as 2 words. Don't use "filepath". When writing out file paths, use a forward slash ( / ) for *nix and a backslash ( \ ) for Windows. List both the *nix and Windows file paths, in that order.

Use angle brackets to indicate parts of a file path that differ by user or operating system, such as /home/<username>/.login.

The term used for a file category, such as Portable Document Format (PDF) documents or Graphics Interchange Format (GIF) files. Use a file type when you write about a broad file category. It's okay to shorten the file type as an acronym or initialism.

Capitalize the acronym or initialism when it's used as an adjective or when it stands alone in text. An exception to the standard styling for file types is for configuration files (.conf files) which are styled like a file name extension.

Do this	Don't do this
The upload must be in JSON format. Upload photos as JPG files. Download the topic as a PDF. Save the export as a CSV file. The TAR file can have a .tar, .tar.gz, or .tgz extension. Update the stanza in the .conf file.	The upload must be a .json. Upload photos as jpegs. Download the topic as a pdf. Save the export as a .CSV. The TAR file can have a TAR, .tar.GZ, or .TGZ extension. Update the stanza in the CONF file.

Use when referring to file system structures in a GUI context. For GUI contexts, don't use "directory", which is typically used in CLI contexts.

Do this	Don't do this
Remove the existing Splunk_TA_Windows folder from $SPLUNK_HOME/etc/shcluster/apps.	Remove the existing Splunk_TA_Windows directory from $SPLUNK_HOME/etc/shcluster/apps.

Note: If you need to discuss both CLI and GUI options, use language that ensures users understand the terminology interchangeably.

Use to refer to parts of documentation or page elements that immediately come after a user's current location, such as "in the following section" or "in the following table".

If appropriate, you can also use "later" and "next".

Use this term to describe how Splunk product features work. Don't use to refer to the capabilities or features of a product.

Do this	Don't do this
The following update provides new functionality in the custom visualizations framework.	Dashboards are a functionality of Splunk Cloud Platform.

Use to indicate a hypothetical situation, a possibility, or a condition that must be met for a particular action, behavior, or event to occur. Don't use "when" if the situation is hypothetical.

Do this	Don't do this
If the search returns too many results, try refining your search.	When the search returns too many results, try refining your search.

Use as a verb, not as a noun. Use to mean installing a piece of software. Use "deploy" to describe the process of setting up the components for a partial or entire system, which can include installing and configuring software and hardware.

Do this	Don't do this
Install the Splunk Enterprise .tgz file. You can install the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.	Deploy the Splunk Enterprise .tgz file. You can deploy the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.

Use as 1 word in the context of getting data into a Splunk product.

Do this	Don't do this
Get data into Splunk User Behavior Analytics.	Get data in to Splunk User Behavior Analytics.

Use as a modifier, not as a standalone term. Choose the most precise noun based on the context.

Do this	Don't do this
JSON format JSON schema JSON representation JSON attribute	the JSON

Include a hyphen. Don't use a slash or space. Don't use the phrase "key value" on its own.

Do this	Don't do this
key-value pair	key value key/value pair

It's okay to use "launch" to match a UI. Otherwise, use "open" instead.

Do this	Don't do this
Uncheck the Launch browser with Splunk check box to prevent your browser from opening.	Start Splunk Enterprise and launch Splunk Web. Place a shortcut on your desktop to launch Splunk Enterprise.

Don't use to refer to a location in a document. Use temporal language, such as "earlier", "previous", "following", "next", or "later". Directional or visual instructions are unhelpful to visually impaired users, and locations of elements can change depending on the device being used to read the content.

Use lowercase letters when writing generally about the color contrast choice that a user can select for their UI. Follow the capitalization used in the UI when writing about a button or other component in the Splunk product UI.

Do this	Don't do this
You can choose to view Splunk Web in a light theme or a dark theme. In the SPL Editor, select Themes, and then Light Theme or Dark Theme.	You can view Splunk Web in a Light Theme.

Use as 2 words as a verb. Follow with "to" to describe entering a username or password for a system. Use "as" to describe entering with a specific role or privileges. Don't use "log on".

Do this	Don't do this
Log in to Splunk Web. Log in as an administrator.	Log into Splunk Web. Login to Splunk Web. Log on as an administrator.

Use as 1 word as a noun or adjective. Don't use "logon".

Do this	Don't do this
The login interface is easy to use.	The log in password is "changeme". The logon password is "changeme".

Use as 2 words as a verb.

Do this	Don't do this
Set the CSV lookup to look up the host.	Set the CSV lookup to lookup the host.

Don't use. Use "manager" for the centralized management, leading, or coordinating node, and when you discuss the relationship of that node with other nodes that interact with it. See manager node in the Splexicon.

Do this	Don't do this
License manager Indexer cluster manager node	License master Indexer cluster master node

Use as a singular mass noun. Write "metadata is" rather than "metadata are".

Do this	Don't do this
Metadata lets users find, filter, and aggregate metric time series and other objects. Select the link targets for this trigger if the metadata is visible.	The metadata are written to data files. The metadata include the key name, value, and start and end time.

Use when referring to an icon with 3 horizontal dots (  ) or 3 vertical dots (  ) in a Splunk GUI. Don't capitalize. Include an inline image of the icon when possible.

Do this	Don't do this
Select the more icon (  )	Select the more button(  ). Select the more icon (   ). Select the More icon (  ).

Don't include a hyphen in words that begin with the prefix "multi".

Do this	Don't do this
multiserver multisite multivalue	multi-server multi-site multi-value

Write in lowercase letters. Use only in tables or lists to refer to a value that is not applicable or not available. Spell out instead of abbreviating when used in paragraph text.

Do this	Don't do this
n/a	N/A N.A. NA

Don't use. Use "hard-to-find" instead.

Do this	Don't do this
Troubleshoot a hard-to-find case by searching for a specific trace.	Troubleshoot a needle-in-a-haystack case by searching for a specific trace.

Use to refer to parts of documentation or page elements that immediately follow a user's current location in a topic, such as "in the next section".

If appropriate, you can also use "following" and "later".

Don't include a hyphen.

Do this	Don't do this
nonzero	non-zero

Include a hyphen and treat "premises" as plural. Use instead of "on premise", "on-premise", "on prem", or "on-prem".

Do this	Don't do this
If your Splunk platform deployment is installed on-premises, you can... A deployment that uses an on-premises search head... For on-premises Splunk Enterprise instances only.	A deployment that uses an on-premise search head... On-the-premises in a server room Running Splunk Enterprise on-prem

Place immediately before or after the word or phrase it modifies.

Do this	Don't do this
The sdselect command supports only the required arguments for the tonumber() and tostring() functions.	The sdselect command only supports the required arguments for the tonumber() and tostring() functions.

Use a numeral followed by the percent sign ( % ) to specify an exact percentage. Don't use the word "percent".

Do this	Don't do this
10%	Ten percent 10 percent

Use when referring to a SQL command or a database. To refer to a Splunk search, use "search" instead of "query".

Do this	Don't do this
database query SQL query	Splunk query SPL query write a query to generate a single value visualization

Include a hyphen. Use as an adjective.

Do this	Don't do this
The file is read-only. Read-only memory stores information that can be read, but not modified.	The readonly file. The file is read only. Read only memory stores information that can be read, but not modified.

Use the forward slash instead of a hyphen when you write about read, write, and delete permissions.

Do this	Don't do this
Add read/write permissions for all users. The role restricts read/write/delete permissions.	Add read-write permissions for all users. Add read and/or write permissions for all users.

Use as 2 words when used as a noun. Include a hyphen when used as an adjective.

Do this	Don't do this
Perform the search in real time. real-time alert	Perform the search in real-time. Perform the search in realtime. real time alert

Use in the context of searches or other commands. Don't use "execute" or "perform".

Do this	Don't do this
Run the search.	Execute the search. Perform the search.

Use as an alternative option to "rerun". Use "again" only if it is necessary for clarity.

Use as 1 word as a noun or adjective. Don't use "run time" or "run-time".

Do this	Don't do this
runtime considerations the total runtime	run-time considerations the total run time

Use instead of "query" to refer to a Splunk search. See search in the Splexicon.

Do this	Don't do this
Splunk search Write a search to generate a single value visualization Run a search	Splunk query Write a query to generate a single value visualization Run a query

Use instead of "check out" for references and cross-references. To describe the UI, use "view" instead.

Do this	Don't do this
For an introduction to forwarders, see About forwarding and receiving data.	Check out About forwarding and receiving data.

Use to highlight text, choose menu items, go to a link, push a button, open a tab, check a check box, or interact with a keyboard. Don't use "specify", "click", or "press".

Do this	Don't do this
Select the link. Select Esc. Select Patterns.	Click the link. Press Esc. Click Patterns.

Don't use. Avoid the subjunctive mood, and use imperative or indicative mood instead.

Do this	Don't do this
You must have the administrator role to complete this task. Back up your data before you begin.	You should have the administrator role to complete this task. You should back up your data before you begin.

Don't use. Use "peer" for nodes that interact with the centralized management, leading, or coordinating node.

Do this	Don't do this
License peer Indexer cluster peer node	License slave

Include a hyphen when used as an adjective.

Do this	Don't do this
A space-separated list	A space separated list

When used alone, use "Splunk" to refer only to the company, not to any product. Don't use in the possessive form.

Do this	Don't do this
Splunk has a mascot called Buttercup. a Splunk customer Splunk.com account Configure Splunk software Restart the Splunk platform. the Splunk universal forwarder	a Splunk account Configure your Splunk. Restart Splunk. Splunk's universal forwarder

Use as a proper noun to refer to the software, spelled with initial capital letters. Don't include a definite article, use as a possessive, or shorten the name using an acronym or abbreviation.

Do this	Don't do this
Splunk Cloud Platform	The Splunk Cloud Platform Splunk Cloud platform Splunk Cloud SCP Splunk Cloud Platform's features

Use as a proper noun to refer to https://dev.splunk.com, spelled with initial capital letters and using a definite article. Don't use abbreviations or acronyms in place of this term. Don't confuse this term with the Splunk Developer Program.

Do this	Don't do this
See the Splunk Developer Portal.	See Splunk Developer Portal. See the Splunk dev portal. See SDP.

Use as a proper noun to refer to the software, spelled with initial capital letters. Don't include a definite article or use as a possessive.

Do this	Don't do this
Splunk Enterprise	The Splunk Enterprise Splunk Enterprise platform Splunk Enterprise's features

Use to refer to the product suite. Don't omit "Splunk" or use an acronym to shorten the name. Don't include a definite article or use as a possessive. Don't refer to the suite as a platform.

Do this	Don't do this
Splunk Observability Cloud	Observability Cloud SOC The Splunk Observability Cloud Splunk Observability Cloud platform Splunk Observability Cloud's features

Use to refer to both Splunk Cloud Platform and Splunk Enterprise. Don't capitalize "platform" or use as a possessive. Include a definite article in most cases. Use as a modifier when writing about an instance, a deployment, or an environment when you're describing multiple platform products.

Do this	Don't do this
the Splunk platform a Splunk platform instance your Splunk platform deployment version 7.2.4 of the Splunk platform	Splunk Platform the Splunk platform's features Splunk server instance a Splunk instance

Use to refer to any combination of Splunk Enterprise, Splunk Cloud Platform, any Splunk-supported apps and add-ons, and any other software produced by Splunk. Don't capitalize "software" or use it as a possessive.

Do this	Don't do this
Splunk software	Splunk Software Splunk Software instance Splunk software's features

Use to refer to the graphical user interface for the Splunk platform. See Splunk Web in the Splexicon.

Do this	Don't do this
Splunk Web	SplunkWeb a Splunk UI the Splunk UI Splunk Web UI Web UI Web Interface

Use when referring specifically to the Splunk Enterprise process, the service that is installed with Splunk Enterprise on Windows machines, or a service used to manage the splunkd process on Linux machines. Don't use in place of Splunk Enterprise or the Splunk platform. See splunkd in the Splexicon.

Do this	Don't do this
Splunk Enterprise installs a process called splunkd on your host. Configure systemd to manage splunkd as a service.	After installing the add-on, restart splunkd.

Don't use as a verb.

Do this	Don't do this
Log in to the instance using SSH. Use Secure Shell (SSH) to log in to the instance.	SSH into the instance.

Use only in specific cases where the word "stack" is used, like in the name of a CLI command or an API. Don't use to refer to a Splunk Cloud Platform deployment.

Do this	Don't do this
Use the add-stack command to configure a Splunk Cloud Platform deployment.	Splunk Cloud Platform stack

Write as 1 word with no hyphen. Use this term only as an adjective.

Do this	Don't do this
a standalone instance	a stand alone instance a stand-alone instance

Don't use. Spell out "version" instead of abbreviating with a "v".

Do this	Don't do this
Splunk platform versions 6.6.x and 7.0.x	Splunk platform v6.6.x, v7.0.x

A validated architecture of Splunk Cloud Platform. Always capitalize. Don't include the definite article and don't use "Victoria" on its own. Use with the preposition "on" when describing how to use an Experience or its components. Always refer to "Experience" in the same sentence when describing the designation.

Do this	Don't do this
All customers will move to Victoria Experience. Your Splunk Cloud Platform environment has 1 of 2 possible Experience designations: Victoria or Classic.	All customers will move to Victoria. The Splunk Cloud Platform environment is either Victoria or Classic.

Use instead of "see" to describe the UI.

Do this	Don't do this
Use this chart to view the percentage of crashes. View app usage in this dashboard.	Use this chart to see the percentage of crashes. See app usage in this dashboard.

Use to indicate an action, behavior, or event that is expected or certain to occur. This term implies a cause-and-effect relationship.

Do this	Don't do this
When a signal crosses the static threshold, an alert is triggered.	After a signal crosses the static threshold, an alert is triggered. If a signal crosses the static threshold, an alert is triggered.

Don't use. Use "allow list" as a noun and "allow" or "include" as a verb. For a single item, use "allow rule" or "allow entry".

There are additional synonyms you can use in specific situations. "Allow" refers to access, "accept" refers to validity, and "include" refers to inclusion. For IP traffic, for example, "allow" is suitable. For files or rules, "include" might be more specific.

Do this	Don't do this
Set up an allow list to include specific incoming data.	Whitelist the specific incoming data.

Don't use. Use "wildcard" with an asterisk in parentheses after the term to denote the search action of matching characters in string values.

Do this	Don't do this
You can use a wildcard ( * ) to match noninternal indexes in searches.	Indexes in searches can be wildcarded, although * matches only noninternal indexes.

Avoid using this term. Use only if you need to refer to the UI component and the label contains the word "wizard". If you must refer to the general component, use "guided setup" sparingly. Always aim to describe the user's actions and goals instead of the components and features of the product.

Do this	Don't do this
In Splunk Web, select Add Data to start getting data in. Select App Wizard to design and develop an app framework. Follow the step-by-step process provided in the Splunk Observability Cloud guided setup.	Use the Add Data wizard in Splunk Web. Follow the step-by-step process provided in the Splunk Observability Cloud wizard.

Don't use. Avoid subjunctive mood. Write in the indicative or imperative mood instead.

Do this	Don't do this
The example shows a type of script you can create for your deployment.	The example shows a type of script you would create for your deployment.

Use a lowercase "x" to represent a range of HTTP status codes.

Do this	Don't do this
4xx The value of the span's status code tag is set to 5xx.	4XX The value of the span's status code tag is set to 5XX.

Use a lowercase "x" at the relevant place in the version number when referring to maintenance builds, minor versions, or releases for a product. Don't include a "v" before the number.

Do this	Don't do this
Splunk Enterprise 7.x Splunk platform versions 6.6.x and 7.0.x	Splunk Enterprise v7.x Splunk platform versions 6.6.X and 7.0.X