Splunk Search Autocompletion Tool README

This is the README for the Splunk Search Autocompletion Tool.

Features

• Works on .spl and .splunk files
• Autocompleting commands
• Syntax for main, eval, and stats commands
• Hover for commands and keywords
• Description for commands
• Related main commands
• Format SPL VSCode command to format searches

How to install

Prerequisites

In order to install this extension you must have installed the Splunk Search Syntax Highlighter. This will be installed for you.

Install from Source

Install from source by downloading this repo and unzipping into your vscode extensions directory (ususally ~/.vscode/extensions)

Install in Visual Studio Code directly

Install directly in visual studio by going to the extensions tab and searching for "splunk search". The quotes are imperative as the words are normally not treated as a phrase. Click the Install button on the extension with the same name as this README and you're good to go.

TODO

• Syntax for main commands
• Syntax for eval and stats commands
• Description for commands
• Related main commands
• Add in suggestion after pipe, stats, and eval commands for respective commands
• Add in suggestion after stats commands with arguments for keywords (AS, BY, OVER, WHERE, etc...)
• Instead of JSON files, get info directly from Splunk's website so that manual updating is not required
• Implement hovers for all commands to increase syntax and description visibility
• Publish to VSCE Marketplace
• Bundle with Syntax highlighter
• Add prettifier