Splunk® Style Guide

Splunk Style Guide

The guidelines in the Splunk Style Guide establish best practices for writing technical documentation. Search docs.splunk.com to find documentation related to Splunk products.

Line breaks

When you include searches in Splunk documentation, split up long lines of code with line breaks so that the lines of code fit within the page width and don't extend off the screen.

When deciding where to break a search string, prioritize the break based on the following list:

  1. Before a pipe ( | )
  2. At a space
  3. Before an open parenthesis ( ( ) or left bracket ( [ )
  4. After a close parenthesis ( ) ) or right bracket ( ] )
  5. Before or after an equal sign ( = )
  6. Before or after any equation symbol, such as an asterisk ( * ), forward slash ( / ), plus sign ( + ), greater than symbol ( > ), less than symbol ( < ), or minus sign ( - )
  7. After a dot ( . ), such as in a URL

For more information on formatting searches and other forms of code in Splunk documentation, see Formatting reference.

Line break example

Consider the following search:

sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, distinct_count(productId), values(productId) by clientip

Because this search is longer than 1 line, a logical place to break this line is between clientip=87.194.216.51 and | stats, rather than between count, and distinct_count(productId).

The break appears as follows:

sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, distinct_count(productId), values(productId) by clientip

Last modified on 07 February, 2024
Formatting reference   Abbreviations

This documentation applies to the following versions of Splunk® Style Guide: current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters