SPLUNK 笔记

Required and optional arguments

1. <> 必选参数
2. []可选参数

1. 数据类型

Data types

The nomenclature used for the data types in SPL syntax are described in the following table.

Syntax	Data type	Notes
<bool>	boolean	Use true or false. Other variations are accepted. For example, for true you can also use 't', 'T', 'TRUE', 'yes', or the number one ( 1 ). For false you can also specify 'no', the number zero ( 0 ), and variations of the word false, similar to the variations of the word true.
<field>	A field name. You cannot specify a wild card for the field name.	See <wc-field>.
<int> or <integer>	An integer that can be a positive or negative value.	Sometimes referred to as a "signed" integer. See <unsigned int>.
<string>	string	See <wc-string>.
<unsigned int>	unsigned integer	An unsigned integer must be positive value. Unsigned integers can be larger numbers than signed integers.
<wc-field>	A field name or a partial name with a wildcard character to specify multiple, similarly named fields.	Use the asterisk ( * ) character as the wildcard character.
<wc-string>	A string value or partial string value with a wildcard character.	Use the asterisk ( * ) character as the wildcard character.