@@ -7,6 +7,7 @@ XOR: 'XOR';
7
7
8
8
BY : ' BY' | ' by' ;
9
9
AS : ' AS' | ' as' ;
10
+ IN : ' IN' ;
10
11
11
12
IF : ' IF' | ' if' ;
12
13
CASE : ' CASE' | ' case' ;
@@ -107,7 +108,7 @@ reserved_keywords
107
108
| ' span'
108
109
| ' sort'
109
110
| ' transpose'
110
- | ' in '
111
+ | IN
111
112
| ' allnum'
112
113
| ' delim'
113
114
| ' extendtimerange'
@@ -150,21 +151,9 @@ PLUS: '+';
150
151
MINUS : ' -' ;
151
152
CONCAT : ' .' ;
152
153
153
- WORD
154
- : LetterOrDigitOrPunctFinal LetterOrDigitOrPunct*? LetterOrDigitOrPunctFinal+?
155
- | LetterOrPunctFinal
156
- ;
157
-
158
- left_side_value
159
- : WORD
160
- | ID
161
- | reserved_keywords
162
- ;
163
-
164
154
fieldname
165
- : WORD
166
- | ID
167
- | reserved_keywords
155
+ : ID
156
+ // | reserved_keywords
168
157
// | '"' fieldname '"'
169
158
| ' *'
170
159
| STRING
@@ -284,42 +273,39 @@ spl_generating_command
284
273
;
285
274
286
275
spl_command_search
287
- : (' search' ) search_arg*
276
+ : (' search' ) search_arg+
288
277
;
289
278
290
279
search_arg
291
- : search_arg logical_operator search_arg
292
- | unary_operator search_arg
280
+ : unary_operator search_arg
281
+ | LPAR search_arg RPAR
282
+ | search_arg comparison_operator search_arg
283
+ | search_arg logical_operator search_arg
293
284
| search_arg_expr
294
- | in_expr
295
- | LPAR search_arg+ RPAR
296
285
;
297
286
298
287
search_arg_expr
299
- : keyword_expr
288
+ : fieldname
289
+ | keyword_expr
300
290
| wildcard_expr
301
- | field_comparison_expr
291
+ | in_expr
302
292
| subsearch_expr
303
- | logical_expr
304
- | comparative_expr
305
- | unary_operator search_arg_expr
293
+ // | logical_expr
294
+ // | comparative_expr
306
295
;
307
296
308
297
// https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Eval
309
298
// eval <field>=<expression>["," <field>=<expression>]...
310
299
spl_command_eval
311
- : ' eval' left_side_value EQ eval_expr (' ,' left_side_value ' = ' eval_expr)*
300
+ : ' eval' fieldname EQ eval_expr (' ,' fieldname EQ eval_expr)*
312
301
;
313
302
314
303
eval_expr
315
304
: eval_expr math_operator eval_expr
316
305
| function_call_expr
317
306
| INT
318
307
| unary_operator INT
319
- | STRING
320
- | WORD
321
308
| ID
322
- | reserved_keywords
323
309
| subsearch_expr
324
310
| LPAR eval_expr RPAR
325
311
;
@@ -350,14 +336,14 @@ tstats_fieldname_list
350
336
// [WHERE <search-query> | <field> IN (<value-list>)]
351
337
// [BY (<field-list> | (PREFIX(<field>))) [span=<timespan>] ]
352
338
spl_command_tstats
353
- : ' tstats' (( ' summariesonly' ' = ' boolean_value)
354
- | (' prestats' ' = ' boolean_value)
355
- | (' local' ' = ' boolean_value)
356
- | (' append' ' = ' boolean_value)
357
- | (' include_reduced_buckets' ' = ' boolean_value)
358
- | (' allow_old_summaries' ' = ' boolean_value)
359
- | (' chunk_size' ' = ' INT )
360
- | (' fillnull_value' ' = ' STRING ))*
339
+ : ' tstats' (( ' summariesonly' EQ boolean_value)
340
+ | (' prestats' EQ boolean_value)
341
+ | (' local' EQ boolean_value)
342
+ | (' append' EQ boolean_value)
343
+ | (' include_reduced_buckets' EQ boolean_value)
344
+ | (' allow_old_summaries' EQ boolean_value)
345
+ | (' chunk_size' EQ INT )
346
+ | (' fillnull_value' EQ STRING ))*
361
347
aggregation_expr_list
362
348
(FROM ( (' datamodel' EQ fieldname)
363
349
| (loose_string)
@@ -400,11 +386,11 @@ spl_command_fields
400
386
fields_modifier : MINUS |PLUS ;
401
387
402
388
in_expr
403
- : fieldname ' IN ' LPAR keyword_expr (' ,' keyword_expr)* RPAR
404
- | fieldname ' IN ' LPAR keyword_expr (keyword_expr)* RPAR // XXX: Should be banned
405
- | fieldname ' IN ' LPAR wildcard_expr (' ,' wildcard_expr)* RPAR
406
- | fieldname ' IN ' LPAR wildcard_expr (wildcard_expr)* RPAR // XXX: Should be banned
407
- | fieldname ' IN ' LPAR subsearch_expr RPAR
389
+ : fieldname IN LPAR keyword_expr (' ,' keyword_expr)* RPAR
390
+ | fieldname IN LPAR keyword_expr (keyword_expr)* RPAR // XXX: Should be banned
391
+ | fieldname IN LPAR wildcard_expr (' ,' wildcard_expr)* RPAR
392
+ | fieldname IN LPAR wildcard_expr (wildcard_expr)* RPAR // XXX: Should be banned
393
+ | fieldname IN LPAR subsearch_expr RPAR
408
394
;
409
395
410
396
logical_expr
@@ -443,7 +429,6 @@ field_comparison_expr
443
429
444
430
right_value_expr
445
431
: timeExpression
446
- | WORD
447
432
| boolean_value
448
433
| wildcard_expr
449
434
| ID
@@ -528,7 +513,6 @@ aggregation_expr
528
513
aggregation_function_expr
529
514
: aggregation_function
530
515
| aggregation_function LPAR aggregation_function_expr RPAR
531
- | aggregation_function LPAR eval_expr RPAR
532
516
| aggregation_function LPAR stats_fieldname RPAR
533
517
;
534
518
@@ -545,7 +529,7 @@ spl_command_mvexpand // XXX #25
545
529
// https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Mvcombine
546
530
// mvcombine [delim=<string>] <field>
547
531
spl_command_mvcombine
548
- : ' mvcombine' (' delim' ' = ' loose_string)? fieldname
532
+ : ' mvcombine' (' delim' EQ loose_string)? fieldname
549
533
;
550
534
551
535
spl_command_transaction
@@ -557,8 +541,7 @@ transaction_option
557
541
;
558
542
559
543
loose_string
560
- : WORD
561
- | STRING
544
+ : STRING
562
545
| ID
563
546
;
564
547
@@ -569,8 +552,8 @@ sed_expr: STRING;
569
552
// rex [field=<field>]
570
553
// ( <regex-expression> [max_match=<int>] [offset_field=<string>] ) | (mode=sed <sed-expression>)
571
554
spl_command_rex
572
- : ' rex' ' field' ' = ' fieldname regex_string ((' max_match' ' = ' INT )|(' offset_field' ' = ' loose_string))*
573
- | ' rex' ((' field' ' = ' fieldname)|(' mode' ' = ' SED ))+ sed_expr
555
+ : ' rex' ' field' EQ fieldname regex_string ((' max_match' EQ INT )|(' offset_field' EQ loose_string))*
556
+ | ' rex' ((' field' EQ fieldname)|(' mode' EQ SED ))+ sed_expr
574
557
| ' rex' STRING
575
558
;
576
559
@@ -582,10 +565,10 @@ spl_command_append
582
565
;
583
566
584
567
subsearch_option
585
- : ' extendtimerange' ' = ' boolean_value
586
- | ' maxtime' ' = ' INT
587
- | ' maxout' ' = ' INT
588
- | ' timeout' ' = ' INT
568
+ : ' extendtimerange' EQ boolean_value
569
+ | ' maxtime' EQ INT
570
+ | ' maxout' EQ INT
571
+ | ' timeout' EQ INT
589
572
;
590
573
591
574
// https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Makeresults
@@ -619,10 +602,10 @@ spl_command_bucket
619
602
;
620
603
621
604
bin_option // XXX: I use loose_string randomly
622
- : ' bins' ' = ' loose_string
623
- | ' minspan' ' = ' loose_string
624
- | ' span' ' = ' loose_string
625
- | ' aligntime' ' = ' loose_string
605
+ : ' bins' EQ loose_string
606
+ | ' minspan' EQ loose_string
607
+ | ' span' EQ loose_string
608
+ | ' aligntime' EQ loose_string
626
609
;
627
610
628
611
// https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Join
@@ -633,11 +616,11 @@ spl_command_join
633
616
634
617
// type=(inner | outer | left) | usetime=<bool> | earlier=<bool> | overwrite=<bool> | max=<int>
635
618
join_option
636
- : ' type' ' = ' ID
637
- | ' usetime' ' = ' boolean_value
638
- | ' earlier' ' = ' boolean_value
639
- | ' overwrite' ' = ' boolean_value
640
- | ' max' ' = ' INT
619
+ : ' type' EQ ID
620
+ | ' usetime' EQ boolean_value
621
+ | ' earlier' EQ boolean_value
622
+ | ' overwrite' EQ boolean_value
623
+ | ' max' EQ INT
641
624
;
642
625
643
626
// https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Makemv
@@ -647,10 +630,10 @@ spl_command_makemv
647
630
;
648
631
649
632
makemv_option
650
- : ' delim' ' = ' loose_string
651
- | ' tokenizer' ' = ' loose_string
652
- | ' allowempty' ' = ' boolean_value
653
- | ' setsv' ' = ' boolean_value
633
+ : ' delim' EQ loose_string
634
+ | ' tokenizer' EQ loose_string
635
+ | ' allowempty' EQ boolean_value
636
+ | ' setsv' EQ boolean_value
654
637
;
655
638
656
639
// https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Timechart
@@ -664,7 +647,7 @@ spl_command_timechart
664
647
;
665
648
666
649
timechart_option
667
- : ' span' EQ WORD
650
+ : ' span' EQ ID
668
651
| ' sep' EQ STRING
669
652
| ' format' EQ STRING
670
653
| ' partial' EQ boolean_value
0 commit comments