Usage dictionary

The following list outlines terms to use and avoid in Splunk documentation.

*

*nix

Use to refer to both UNIX and Linux together. If only 1 system is supported, use "UNIX" or "Linux". See *nix in the Splexicon.

A

abnormal

Don't use. Use "atypical" or "not typical".

abort

Don't use unless referring to a specific command or system language. Otherwise, use "force quit", "cancel", "fail", "close", "stop", "end", or another term that accurately reflects the situation.

above

Don't use to refer to a location in a document. Directional or visual instructions are unhelpful to visually impaired users. Use "higher" to refer to versions of software. Use "earlier" or "previous" to refer to page elements. See higher, earlier, and previous.

ad hoc

Use only when referring to an unscheduled search, otherwise don't use Latin abbreviations or terms. Don't use any other term for a search that a user launches manually. In references not about an unscheduled search, use "if needed". See ad hoc search in the Splexicon.

add-on

Include a hyphen. The plural form is "add-ons". The term takes a definite article. You can write it as "the add-on" after the first instance of the full name of the add-on. Use "add-on" when writing about a Technical Add-on, Supported Add-on, or Domain Add-on in Splunk docs. See add-on in the Splexicon.

Do this

add-on

the add-on

the Splunk Add-on for [name of third-party vendor]

Don't do this

add-On

Add-On

addon

AddOn

admin, administrator

For the most part, use "admin" as an adjective to identify the role-based access control label and "administrator" as a noun to identify a user's job title or responsibility. Don't capitalize.

Do this

You must be assigned the admin role to add members.

As a Splunk administrator, you must onboard new members in your team.

Don't do this

You must be an admin to add members.

You must be a Splunk Admin to onboard new members in your team.

after

Use to denote a chronological sequence of events that doesn't rely on cause and effect. Don't use to mean "when". See also when.

Do this

After you install the update, save your changes.

Don't do this

After a user logs in to your organization, a SessionLog event is created.

allows you to

Avoid this phrase. Focus on the goals a user can achieve with their product rather than what the product lets a user do.

AM

Write with capital letters and without periods. Use to mean between midnight and 11:59 in the morning when writing the time of day. See 12-hour clock.

and/or

Don't use. Pick the word that best fits the sentence.

anti

Don't include a hyphen.

Do this

antivirus

app

Use to refer to an application that runs on the Splunk platform. See app in the Splexicon.

at present

Don't use. Use "now".

at this point

Don't use.

auto

Don't include a hyphen.

Do this

autodiscover

autoscale

Don't do this

auto-discover

auto discover

auto-scale

B

back end, back-end

Use as 2 words when used as a noun. Include a hyphen when used as an adjective. Don't use if you can find a more specific term, such as server, operating system, database, network, and the like.

backend

Don't use.

base directories

Put the variable name for a directory in all capital letters regardless of the operating system. If the variable name has spaces, replace the spaces with the underscore ( _ ) character.

For *nix, precede the base directory with a dollar sign ( $ ). For Windows, surround the base directory with percent signs ( % ).

*nix

$SPLUNK_HOME

Windows

%SPLUNK_HOME%

basic steps

Don't use. Use "steps".

below

Don't use to refer to a location in a document. Directional or visual instructions are unhelpful to visually impaired users. Use "lower" to refer to versions of software. Use "following", "later", or "next" to refer to page elements. See lower, following, later, and next.

blacklist

Don't use. Use "deny list" as a noun and "deny" as a verb. There are additional synonyms you can use in specific situations: "deny" refers to access, "reject" refers to validity, and "exclude" refers to inclusion. For IP traffic, for example, "deny" is suitable. For files or rules, "exclude" might be more specific. See also whitelist.

Do this

Deny the incoming data.

Set up a deny list to exclude specific incoming data.

Don't do this

Blacklist the specific incoming data.

Set up a blacklist to exclude specific incoming data.

Boolean

The term for the logical operator that takes one of two values, generally True and False. Always capitalize.

bulletproof

Don't use. Use "safe", "secure", "solid", "impenetrable", or another unambiguous term.

C

can not

Don't use as 2 words. Use "can't" or "cannot".

can

Use to mean ability.

capability

A user action within the Splunk platform. Use this term to refer to Splunk role-based access controls (RBAC). See capability in the Splexicon. Don't use to refer to the functionality or features of a product. See functionality and feature.

Do this

Each role contains at least 1 capability. Capabilities define what users who hold a certain role can do.

Don't do this

The latest release of Splunk Enterprise Security has the following new capabilities.

case sensitive, case-sensitive

Don't include a hyphen when you write the term after the noun that it modifies. Include a hyphen when you write the term before the noun that it modifies.

Do this

the password is case sensitive

a case-sensitive username

Don't do this

the password is case-sensitive

a case sensitive username

check box

Use as 2 words. Write "check or uncheck a check box", or "select or deselect a check box".

check out

Don't use. Use "see".

click

Don't use. Use "select". Avoid terms that are specific to certain devices and input methods. For more information, see select.

choose

Don't use when referring to UI selections. Use "select".

comma separated, comma-separated

Don't include a hyphen when you write the term after the noun that it modifies. Include a hyphen when you write the term before the noun that it modifies.

Do this

the list is comma separated

a comma-separated list

Don't do this

the list is comma-separated

a comma separated list

command line, command-line

Use as 2 words when used as a noun. Include a hyphen when used as an adjective.

Do this

from the command line

command-line interface

command-line tool

Don't do this

from the command-line

command line interface

command line tool

.conf file

Use lowercase letters with a period in front or spell out "configuration file". See configuration file in the Splexicon.

Do this

.conf file

configuration file

Don't do this

conf file

CONF file

could

Don't use. Use "can". Avoid subjunctive mood. See Write in indicative or imperative mood.

D

DA

The abbreviation for Domain Add-on. Don't use DA when you write about the product. Use "add-on". It's okay to use "DA" in a file or path. See add-on.

dark mode

Don't use. Use "dark theme".

dark theme

Use lowercase letters when writing generally about the color contrast choice that a user can select for their UI. Don't use "dark mode". Follow the capitalization used in the UI.

Do this

You can choose to view Splunk Web in a light theme or a dark theme.

In the SPL Editor, select Themes, and then Light Theme or Dark Theme.

Don't do this

You can view Splunk Web in a Dark Theme.

View Splunk Web in dark mode.

data

Use as a singular mass noun. Write "data is" rather than "data are", and use "less data" rather than "fewer data". Don't use "datum".

Do this

Data transfer is complete.

The data includes weblogs, call center logs, and order system logs.

Set this parameter if you want to backfill less data than the retention period.

Don't do this

The data aren't visible.

The summary page has fewer data than the source index.

The datum includes syslogs.

data model, datamodel

Use as 2 words when referring to a knowledge object. See data model in the Splexicon. Use as 1 word when used as a search command.

data point

Use as 2 words.

database

Use as 1 word.

dataset

Use as 1 word. See dataset in the Splexicon.

datum

Don't use.

demonstrate

Don't use. Use "show" to mean illustrating or explaining with examples.

deploy

Use to mean the process of setting up the components for a partial or entire system, which can include installing and configuring software and hardware. Use "install" to mean installing a piece of software. See also install.

Do this

Deploy a multisite indexer cluster.

You can deploy forwarders in a wide variety of scenarios.

Don't do this

Deploy the Splunk Enterprise .tgz file.

You can deploy the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.

desire

Don't use. Use "want" to show hope for or to express a need.

Do this

Edit the stanzas to collect the data you want to view.

Don't do this

Edit the stanzas to collect the data you desire.

dialog box

Use as 2 words without "ue".

Do this

In the dialog box

Don't do this

In the dialog

In the dialogue

In the dialogue box

dialogue

Include "ue" when referring to a conversation.

directory

Use when discussing file system structures in a CLI context or when addressing developers who work with file structures programmatically. For CLI contexts, don't use "folder", which is typically used in GUI contexts. See folder.

Do this

Use the ./splunk add command and specify a directory for data ingestion to configure network inputs.

If you need to discuss both CLI and GUI options, use language that ensures users understand the terminology interchangeably.

disable, disabled, disables

Don't use. Choose a plain-language alternative that describes the action or state, such as "deactivate", "deactivated", "deactivates", "deselect", "deselected", "deselects", "hide", "hidden", "hides", "inactive", "turn off", "turned off", "turns off", "unavailable", "makes unavailable", or the like. See also enable.

double-check

Don't use. Use "check" or "make sure".

do not

Use as 2 words when the emphasis is on "not". Otherwise, it's okay to use "don't". See Contractions.

drag-and-drop

Use as an adjective. For a verb use "drag", which implies drop.

drill down, drilldown

Use as 2 words as a verb. Use as 1 word without a hyphen as a noun, adjective, or interactive functionality. See drilldown in the Splexicon.

drop-down

Use only when necessary for clarity. Don't use as a noun. Include "list" with the title of the list for context.

dummy data

Don't use. Use "placeholder data".

E

earlier

Don't use to refer to versions of software. Use "lower". It's okay to use "earlier" to refer to parts of documentation or page elements that precede a user's current location, such as "See <link to section> earlier in this topic". See also previous.

e.g.

Don't use. Spell out "for example". Don't use Latin abbreviations or terms.

enable, enabled, enables

Don't use to show the counteraction of turning off a feature, deactivating a feature, or describing a deactivated feature. Choose a logical plain-language alternative that explains the action or state, such as "activate", "activated", "activates", "select", "selected", "selects", "show", "shows", "turn on", "turned on", "turns on", or the like. See also disable.

enables you to

Avoid this phrase. Focus on the goals a user can achieve with their product rather than what the product lets a user do.

endpoint

Use as 1 word.

enter

Use as a verb to refer to inputting text. Don't use "type" because there are multiple ways to enter text. For more information, see Use device-agnostic language.

Do this

Enter your name.

Enter a password value.

Enter your search in the search bar.

Don't do this

Type your name.

Type a password value.

Type your search in the search bar.

epoch time

Don't use. Use "UNIX time".

etc.

Don't use Latin abbreviations or terms. Be specific and concrete when you write.

execute

Don't use. Use "run".

Experience

Use to refer to a named Experience such as Victoria Experience or Classic Experience. Always capitalize. Don't include a definite article. Use with the preposition "on" when describing how to use an Experience or its components.

Do this

Experience capabilities differ depending on your Experience designation.

Splunk Cloud Platform deployments on Victoria Experience support self-service app installation of private apps and most public apps.

In the About panel, find your Experience: Classic or Victoria.

Don't do this

The Experience capabilities differ depending on the Experience designation.

This feature is supported in Victoria Experience.

Navigate to the About panel to determine your experience.

F

fail over, failover

Use as 2 words when written as a verb. Use as 1 word when written as a noun or adjective.

fatal

Don't use. Use "unrecoverable" or another unambiguous term.

feature

A piece of code shipped with a product that provides a tool a user can use to complete a task or action. Generally, this term is best used in release notes to describe updates to a product release. Avoid documenting features and instead put the emphasis on how a user can achieve their goal. Don't use to refer to the capabilities or functionality of a product. See capability and functionality.

Do this

Version 5.1.0 of the Splunk Add-on for AWS version contains the following new features.

fetch

Don't use. Use "retrieve".

field-value pair

Include a hyphen between "field" and "value" when they modify the word "pair".

Do this

field-value pair

Don't do this

field/value pair

field value pair

file name

Use as 2 words.

file name extensions

The suffix appended to a specific file. Put in lowercase letters. See also file types.

Do this

Update the stanza in indexes.conf.

Upload the upload.json file.

Enlarge the workflow.jpg image.

Create a file named tar-exmpl-2023.tar.

The manual downloads as alert_actions.pdf.

Distribute the file that ends in .splunkconfig.

Don't do this

Update the stanza in the conf file.

Upload the Upload json file.

Enlarge the workflow .jpg.

Create a compressed .tgz archive file.

The manual downloads as alert_actions.PDF.

Send the fat_cats.GIF to the entire team.

file path

A path that describes a location in a file system structure. Use as 2 words. Don't use "filepath". When writing out file paths, use a forward slash ( / ) for *nix and a backslash ( \ ) for Windows. List both the *nix and Windows file paths, in that order.

*nix

$SPLUNK_HOME/bin/splunkd

Windows

%SPLUNK_HOME%\bin\splunkd.exe

Use angle brackets to indicate parts of a file path that differ by user or operating system, such as /home/<username>/.login. See Brackets.

file system

Use as 2 words. Don't use "filesystem".

file types

The term used for a file category, such as Portable Document Format (PDF) documents or Graphics Interchange Format (GIF) files. Use a file type when you write about a broad file category. It's okay to shorten the file type as an acronym or initialism. Capitalize the acronym or initialism when it's used as an adjective or when it stands alone in text. An exception to the standard styling for file types is for configuration files (.conf files) which are styled like a file name extension. See also file name extensions and .conf file.

Do this

The upload must be in JSON format.

Upload photos as JPG files.

Download the topic as a PDF.

Save the export as a CSV file.

The TAR file can have a .tar, .tar.gz, or .tgz extension.

Update the stanza in the .conf file.

Don't do this

The upload must be a .json.

Upload photos as jpegs.

Download the topic as a pdf.

Save the export as a .CSV.

The TAR file can have a TAR, .tar.GZ, or .TGZ extension.

Update the stanza in the CONF file.

filename

Don't use. Use "file name".

filepath

Don't use. Use "file path".

filesystem

Don't use.

first-class entity

Don't use. Use "top-level entity".

flesh-colored

Don't use terminology that assumes race to describe color. Use the most accurate word to describe the color.

folder

Use when referring to file system structures in a GUI context. For GUI contexts, don't use "directory", which is typically used in CLI contexts. See directory.

Do this

Remove the existing Splunk_TA_Windows folder from $SPLUNK_HOME/etc/shcluster/apps.

If you need to discuss both CLI and GUI options, use language that ensures users understand the terminology interchangeably.

following

Use to refer to parts of documentation or page elements that immediately come after a user's current location, such as "in the following section" or "in the following table". See also later and next.

for instance

Don't use. Use "for example".

front end, front-end

Use as 2 words when written as a noun. Include a hyphen when written as an adjective. Don't use if you can find a more specific term, such as the name of the product, feature, app, and the like.

functionality

Use this term to describe how Splunk product features work. Don't use to refer to the capabilities or features of a product. See capability and feature.

Do this

The following update provides new functionality in the custom visualizations framework.

Don't do this

Dashboards are a functionality of Splunk Cloud Platform.

G

grandfathered

Don't use. Use "exempt".

H

hangs

Don't use. Use "stops responding" or "freezes" based on the situation.

hard-code, hard-coded, hard-coding

Use only for a technical or developer audience when referring to coding values and functions directly into the source code rather than obtaining values from general input or external sources. Include a hyphen.

have been

Don't use. Use "are".

have knowledge of

Don't use. Use "know".

have the option to

Don't use. Use "can".

he, him, his

Don't use in documentation. Use "they", "them", their", "a user", "the users", or another inclusive term. See Gender-neutral pronouns.

hex

Write out "hexadecimal". Don't abbreviate.

higher

Use to refer to versions of software. Don't use "later".

hit

Don't use. Use "select", "enter", or another device-agnostic term.

home page

Use as 2 words. Don't use "homepage".

host name

Use as 2 words. Don't use "hostname".

homepage

Don't use. Use "home page".

hostname

Don't use. Use "host name".

hover over

Use to describe the action of positioning the pointer over a UI item. Include the preposition "over". 

I

i.e.

Don't use. Spell out "in other words". Don't use Latin abbreviations or terms.

if

Use to indicate a hypothetical situation, a possibility, or a condition that must be met for a particular action, behavior, or event to occur. See also when.

Do this

If the search returns too many results, try refining your search.

Don't do this

When the search returns too many results, try refining your search.

if you want to

Don't use in a task step. Use "(Optional)" to indicate the step is optional. See Formatting task steps in Numbered lists.

illegal characters

Don't use. Use "invalid characters".

important

Don't use as a note tag or in a callout box. See Best practices for using callout boxes.

install

Use as a verb, not as a noun. Use to mean installing a piece of software. Use "deploy" to describe the process of setting up the components for a partial or entire system, which can include installing and configuring software and hardware. See also deploy.

Do this

Install the Splunk Enterprise .tgz file.

You can install the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.

Don't do this

Deploy the Splunk Enterprise .tgz file.

You can deploy the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.

instance

Use to refer to a Splunk Enterprise instance. Use the full phrase "Splunk Enterprise instance" on the first use in the topic or section. See machine and server.

internet

Lowercase, unless it is the first word in a sentence or part of a proper noun, such as Internet Explorer. Always use with a definite article, such as "the internet".

into

Use as 1 word in the context of getting data into a Splunk product.

Do this

Get data into Splunk User Behavior Analytics.

Don't do this

Get data in to Splunk User Behavior Analytics.

is able to

Don't use. Use "can".

it is recommended

Don't use. Rewrite to make a statement about what the customer must do. See Treat Splunk documentation as a recommendation.

J

JSON

Use as a modifier, not as a standalone term. Choose the most precise noun based on the context.

Do this

the JSON format

the JSON schema

the JSON representation

the JSON attribute

Don't do this

the JSON

just

Don't use.

K

kill

Use only when referring to the *nix command or process. Otherwise, use "quit", "stop", or "end" based on the situation.

key-value pair

Include a hyphen. Don't use a slash or space. Don't use the phrase "key value" on its own.

Do this

key-value pair

Don't do this

key value

key/value pair

keyboard characters

The core section of keys on a keyboard. Special keyboard characters, such as the at symbol ( @ ), pipe ( | ), and forward slash ( / ) , aren't standardized on international keyboards. Be explicit when referring to special keyboard characters. See Show symbols in text.

L

later

Don't use to refer to versions of software. Use "higher". It's okay to use "later" to refer to parts of documentation or page elements that follow a user's current location, such as "See <link to section> later in this topic". See also following and next.

latest

Use to refer to the latest versions of browsers and SaaS.

launch

Don't use. Use "open" to mean starting an operation or to set in motion. It's okay to use "launch" to match the UI.

Do this

Uncheck the Launch browser with Splunk check box to prevent your browser from opening.

Don't do this

Start Splunk Enterprise and launch Splunk Web.

Place a shortcut on your desktop to launch Splunk Enterprise.

left

Don't use to refer to a location in a document. Use "earlier" or "previous". Directional or visual instructions are unhelpful to visually impaired users, and locations of elements can change depending on the device being used to read the content. See earlier or previous.

lets you

Avoid this phrase. Focus on the goals a user can achieve with their product rather than what the product lets a user do.

leverage

Don't use. Use "use".

light mode

Do not use. Use "light theme".

light theme

Use lowercase letters when writing generally about the color contrast choice that a user can select for their UI. Follow the capitalization used in the UI when writing about a button or other component in the Splunk product UI.

Do this

You can choose to view Splunk Web in a light theme or a dark theme.

In the SPL Editor, select Themes, and then Light Theme or Dark Theme.

Don't do this

You can view Splunk Web in a Light Theme.

line break

The point where a line of text ends and a new line starts. Use as 2 words without a hyphen. Don't refer to a forced line break as a "carriage return".

Linux

Use "Linux" if only Linux is supported. Write "*nix" when referring to both Linux and UNIX.

log in

Use as 2 words as a verb. Follow with "to" to describe entering a username or password for a system. Use "as" to describe entering with a specific role or privileges. Don't use "log on".

Do this

Log in to Splunk Web.

Log in as an administrator.

Don't do this

Log into Splunk Web.

Login to Splunk Web.

Log on as an administrator.

log off

Don't use. Use "log out".

log on

Don't use. Use "log in".

log out

Use as a verb. Don't use "log off".

login

Use as 1 word as a noun or adjective. Don't use "logon".

Do this

The login interface is easy to use.

Don't do this

The log in password is "changeme".

The logon password is "changeme".

logoff

Don't use. Use "log out".

logon

Don't use. Use "log in".

logout

Don't use as 1 word. Use "log out".

long press

If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "select and hold" instead of "long press". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "long press".

look up

Use as 2 words as a verb.

Do this

Set the CSV lookup to look up the host.

Don't do this

Set the CSV lookup to lookup the host.

lookup

Use as 1 word as a noun, adjective, or knowledge object. See lookup in the Splexicon.

lower

Use to refer to versions of software. Don't use "earlier".

M

machine

Use to refer to the virtual or physical machine that the instance runs on. See instance and server.

mankind

Don't use. Use "all", "everyone", "humanity", "humankind", or another inclusive term.

master

Don't use. Use "manager" for the centralized management, leading, or coordinating node, and when you discuss the relationship of that node with other nodes that interact with it. See manager node in the Splexicon.

Do this

License manager

Indexer cluster manager node

Don't do this

License master

Indexer cluster master node

master branch

Don't use. Use "main branch".

may

Use only to mean permission. Use "might" for possibility or "can" for ability.

metadata

Use as a singular mass noun. Write "metadata is" rather than "metadata are". See also data.

Do this

Metadata lets users find, filter, and aggregate metric time series and other objects.

Select the link targets for this trigger if the metadata is visible.

Don't do this

The metadata are written to data files.

The metadata include the key name, value, and start and end time.

MFA

Spell out multifactor authentication. Don't use MFA as an abbreviation.

might

Use to mean possibility.

modal

Don't use. Use "dialog box".

more

Use when referring to an icon with 3 horizontal dots () or 3 vertical dots ( ) in a Splunk GUI. Don't capitalize. Include an inline image of the icon when possible.

Do this

Select the more icon ( ).

Don't do this

Select the more button ( ).

Select the more icon ().

Select the More icon ().

mouse over

Don't use. Use "hover over".

multi

Don't include a hyphen.

Do this

multiserver

multisite

multivalue

Don't do this

multi-server

multi-site

multi-value

multivalued field

Don't use. Use "multivalue field". See multivalue field in the Splexicon.

N

n/a

Write in lowercase letters. Use only in tables or lists to refer to a value that is not applicable or not available. Spell out instead of abbreviating when used in paragraph text.

Do this

n/a

Don't do this

N/A

N.A.

NA

needle-in-a-haystack

Don't use. Find a plain language alternative, like "hard-to-find".

Do this

Troubleshoot a hard-to-find case by searching for a specific trace.

Don't do this

Troubleshoot a needle-in-a-haystack case by searching for a specific trace.

next

Use to refer to parts of documentation or page elements that immediately follow a user's current location in a topic, such as "in the next section". See also following and later.

non

Don't include a hyphen.

Do this

nonzero

note that

Don't use in text. Consider whether using a note callout box is more effective. See Best practices for using callout boxes.

null

Write in lowercase letters to refer to an empty value, the null Search Processing Language (SPL) command, or when null appears in SPL search results.

O

on-premises

Include a hyphen and treat "premises" as plural. Don't use "on premise", "on-premise", "on prem", or "on-prem".

Do this

If your Splunk platform deployment is installed on-premises, you can...

A deployment that uses an on-premises search head...

For on-premises Splunk Enterprise instances only.

Don't do this

A deployment that uses an on-premise search head...

On-the-premises in a server room

Running Splunk Enterprise on-prem

once

Use when you mean 1 time and no more. Don't use to mean "after" or "when". See also after and when.

only

Place immediately before or after the word or phrase it modifies.

Do this

The sdselect command supports only the required arguments for the tonumber() and tostring() functions.

Don't do this

The sdselect command only supports the required arguments for the tonumber() and tostring() functions.

out-of-the-box

Don't use. Find a plain language alternative, such as "default" or "prepackaged".

P

path name, pathname

Don't use. Use "path".

percent

Use a numeral followed by the percent sign ( % ) to specify an exact percentage. Don't use the word "percent".

Do this

10%

Don't do this

Ten percent

10 percent

percentage

Use as a noun when not specifying an exact quantity.

perform

Don't use in the context of searches or other commands. Use "run".

pinch

If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "zoom out" instead of "pinch". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "pinch".

please

Don't use.

plug in, plugin

Write as 2 words without a hyphen when you use this term as a verb. Write as 1 word without a hyphen when you use this term as a noun or adjective.

plug-in

Don't use.

PM

Write with capital letters and without periods. Use to mean between noon and 11:59 in the evening when writing the time of day. See 12-hour clock.

point to

Don't use. Use "hover over".

preconfigured

Don't use. Use "configured".

premium apps

Don't use. Use the name of the app instead or describe the apps in another way.

Premium Solutions

Don't use. Use the name of the app instead or describe the apps in another way.

press

Don't use. Use "select" for the action of keying in characters on a keyboard or activating a button.

previous

Use to refer to parts of documentation or page elements that immediately precede a user's current location, such as "in the previous section". See also earlier.

Q

query

Use when referring to a SQL command or a database. Don't use to refer to a Splunk search. See also search.

Do this

database query

SQL query

Don't do this

Splunk query

SPL query

write a query to generate a single value visualization

quite

Don't use.

R

radio button

Don't use "radio" without following it with a noun.

read-only

Include a hyphen. Use as an adjective.

Do this

The file is read-only.

Read-only memory stores information that can be read, but not modified.

Don't do this

The readonly file.

The file is read only.

Read only memory stores information that can be read, but not modified.

read/write, read/write/delete

Use the forward slash instead of a hyphen when you write about read, write, and delete permissions.

Do this

Add read/write permissions for all users.

The role restricts read/write/delete permissions.

Don't do this

Add read-write permissions for all users.

Add read and/or write permissions for all users.

real time, real-time

Use as 2 words when used as a noun. Include a hyphen when used as an adjective.

Do this

Perform the search in real time.

real-time alert

Don't do this

Perform the search in real-time.

Perform the search in realtime.

real time alert

realtime

Don't use.

really

Don't use.

reboot

Don't use. Use "restart". It's okay to use "reboot" when it appears in a command.

recommend

Don't use. Rewrite to state what the customer must do. See Treat Splunk documentation as a recommendation.

reenable

Don't include a hyphen. Or rewrite as "enable again".

reenter

Don't include a hyphen. Or rewrite as "enter again".

regex

Write out "regular expression". Don't use any other variation or abbreviation.

rerun

Don't use. Use "run the search again". Use "again" only if it is necessary for clarity.

right

Don't use to refer to a location in a document. Directional or visual instructions are unhelpful to visually impaired users. See Avoid directional or visual language.

run

Use in the context of searches or other commands. Don't use "execute" or "perform".

Do this

Run the search.

Don't do this

Execute the search.

Perform the search.

runtime

Use as 1 word as a noun or adjective. Don't use "run time" or "run-time".

Do this

runtime considerations

the total runtime

Don't do this

run-time considerations

the total run time

S

(s), (es)

Don't write a lowercase "s" or "es" in parentheses after a noun to indicate both singular and plural. Choose the best option for your sentence. In most cases, using the plural works best for understanding. See also Plurals in parentheses.

SA

The abbreviation for Supporting Add-on. Don't use "SA" when you write about the product. Use "add-on". It's okay to use "SA" in a file or path. See add-on.

sanity check

Don't use. Use "review" or "verification".

scroll

Don't use. Use "read", "skim", or another device-agnostic verb that describes the intended action. See Use device-agnostic language.

search

Use to refer to a Splunk search. Don't use query. See also query. See search in the Splexicon.

Do this

Splunk search

write a search to generate a single value visualization

run a search

Don't do this

Splunk query

write a query to generate a single value visualization

see

Use for references and cross-references. Don't use "check out". To describe the UI, use "view" instead. See view.

Example

For an introduction to forwarders, see About forwarding and receiving.

select

Use to highlight text, choose menu items, go to a link, push a button, open a tab, check a check box, or interact with a keyboard. Don't use "click" or "press". For more information, see Use device-agnostic language.

Do this

Select the link.

Select Esc.

Select Patterns.

Don't do this

Click the link.

Press Esc.

Click Patterns.

select and hold

Use this term to cover the multiple ways a user can interact with a touch-based interface. If you must specify the user's gesture in order to perform an action on a mobile device, you can use "long press".

server

Because the term "server" is used in the IT industry to refer both to a type of software and the machine that the software runs on, avoid this term. Be clear when you refer to the Splunk platform. Use "instance" in the Splunk platform context and "machine" for the virtual or physical machine the instance runs on. See instance and machine.

she, her, hers

Don't use in documentation. Use "they", "them", their", "a user", "the users", or another inclusive term. See Gender-neutral pronouns.

should

Don't use. Avoid the subjunctive mood, and use imperative or indicative mood instead. See Write in indicative or imperative mood.

shows up

Don't use. Use "appears".

sign in

Don't use. See log in.

sign on

Don't use. See log in.

simply

Don't use.

slave

Don't use. Use "peer" for nodes that interact with the centralized management, leading, or coordinating node.

Do this

License peer

Indexer cluster peer node

Don't do this

License slave

source type, sourcetype

Use as 1 word when referring to the field name. Use as 2 words in all other instances. See source type in the Splexicon.

space-separated

Include a hyphen when used as an adjective.

Do this

A space-separated list

Don't do this

A space separated list

specify

Don't use in task steps. Use "select" or "enter".

specifically

Don't use.

spin up, spin down

Don't use. Use "start" and "stop" or the most descriptive action for the virtual machine.

Splunk

When used alone, use "Splunk" to refer only to the company, not to any product. Don't use in the possessive form. See Splunk product terminology.

Do this

Splunk has a mascot called Buttercup.

a Splunk customer

Splunk.com account

Configure Splunk software

Restart the Splunk platform.

the Splunk universal forwarder

Don't do this

a Splunk account

Configure your Splunk.

Restart Splunk.

Splunk's universal forwarder

Splunk Cloud Platform

Use as a proper noun to refer to the software, spelled with initial capital letters. Don't include a definite article, use as a possessive, or shorten the name using an acronym or abbreviation. See Splunk product terminology.

Do this

Splunk Cloud Platform

Don't do this

The Splunk Cloud Platform

Splunk Cloud platform

Splunk Cloud

SCP

Splunk Cloud Platform's features

Splunk Developer Portal

Use as a proper noun to refer to https://dev.splunk.com, spelled with initial capital letters and using a definite article. Don't use abbreviations or acronyms in place of this term. Don't confuse this term with the Splunk Developer Program.

Do this

See the Splunk Developer Portal.

Don't do this

See Splunk Developer Portal.

See the Splunk dev portal.

See SDP.

Splunk Developer Program

Don't use in documentation. This term refers to the program containing developer offerings like services, tooling, and the Splunk Developer Portal. Don't confuse this term with the Splunk Developer Portal itself, which refers to https://dev.splunk.com.

Splunk Enterprise

Use as a proper noun to refer to the software, spelled with initial capital letters. Don't include a definite article or use as a possessive. See Splunk product terminology.

Do this

Splunk Enterprise

Don't do this

The Splunk Enterprise

Splunk Enterprise platform

Splunk Enterprise's features

Splunk Observability Cloud

Use to refer to the product suite. Don't omit "Splunk" or use an acryonym to shorten the name. Don't include a definite article or use as a possessive. Don't refer to the suite as a platform. See Splunk product terminology.

Do this

Splunk Observability Cloud

Don't do this

Observability Cloud

SOC

The Splunk Observability Cloud

Splunk Observability Cloud platform

Splunk Observability Cloud's features

the Splunk platform

Use to refer to both Splunk Cloud Platform and Splunk Enterprise. Don't capitalize "platform" or use as a possessive. Include a definite article in most cases. Use as a modifier when writing about an instance, a deployment, or an environment when you're describing multiple platform products. See Splunk product terminology.

Do this

the Splunk platform

a Splunk platform instance

your Splunk platform deployment

version 7.2.4 of the Splunk platform

Don't do this

Splunk Platform

the Splunk platform's features

Splunk server instance

a Splunk instance

Splunk software

Use to refer to any combination of Splunk Enterprise, Splunk Cloud Platform, any Splunk-supported apps and add-ons, and any other software produced by Splunk. Don't capitalize "software" or use it as a possessive. See Splunk product terminology.

Do this

Splunk software

Don't do this

Splunk Software

Splunk Software instance

Splunk software's features

Splunk Support Portal

Use to refer to the portal where customers with a support contract can get assistance from Splunk Customer Support. Capitalize the initial letters.

Splunk UI

Use only in reference to the product called Splunk UI. For all other cases, use "Splunk Web".

Splunk Web

Use to refer to the graphical user interface for the Splunk platform. See Splunk Web in the Splexicon.

Do this

Splunk Web

Don't do this

SplunkWeb

a Splunk UI

the Splunk UI

Splunk Web UI

Web UI

Web Interface

splunkd

Use when referring specifically to the Splunk Enterprise process, the service that is installed with Splunk Enterprise on Windows machines, or a service used to manage the splunkd process on Linux machines. Don't use in place of Splunk Enterprise or the Splunk platform. See splunkd in the Splexicon.

Do this

Splunk Enterprise installs a process called splunkd on your host.

Configure systemd to manage splunkd as a service.

Don't do this

After installing the add-on, restart splunkd.

spread

If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "zoom in" instead of "spread". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "spread".

SSH

Don't use as a verb.

Do this

Log in to the instance using SSH.

Use Secure Shell (SSH) to log in to the instance.

Don't do this

SSH into the instance.

stack

Use only in specific cases where the word "stack" is used, like in the name of a CLI command or an API. Don't use to refer to a Splunk Cloud Platform deployment.

Do this

Use the add-stack command to configure a Splunk Cloud Platform deployment.

Don't do this

Splunk Cloud Platform stack

standalone

Write as 1 word with no hyphen. Use this term only as an adjective.

Do this

a standalone instance

Don't do this

a stand alone instance

a stand-alone instance

suicide mode

Don't use. Use "time until restart" or another unambiguous term.

switch or switch component

Use as a noun to describe the moveable slider bar in the UI that switches between on and off states. It's okay to say "switch", "switch component", "toggle", or "toggle switch".

synch

Don't use. Use "sync" or "synchronize".

T

takes you to

Don't use. Use "open".

TA

The abbreviation for Technology Add-on. Don't use "TA" when you write about the product. Use "add-on". It is okay to use "TA" in a file or path. See add-on.

tap

If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "select" instead of "tap". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "tap".

tarball

Don't use. Use "TAR file".

The purpose of this document is...

Don't use. Rewrite to be user-focused. See User-focused in A word about Splunk docs.

This document describes...

Don't use. Rewrite to be user-focused. See User-focused in A word about Splunk docs.

This topic describes...

Don't use. Rewrite to be user-focused. See User-focused in A word about Splunk docs.

thus

Don't use.

time series, time-series

Use as 2 words when used as a noun. Include a hyphen when used as an adjective. See time series in the Splexicon.

timeseries

Don't use. Use "time series" as a noun or "time-series" as an adjective.

toggle or toggle switch

Use as a verb to describe moving a switch component between on and off states. Use as a noun to describe the moveable slider bar in the UI that switches between on and off states. It's okay to also call it a "switch", "switch component", or "toggle switch".

type

Don't use to describe user input. Avoid terms that are specific to certain devices and input methods. Use "enter" instead. See enter.

U

UNIX

Use "UNIX" if only UNIX is supported. Write "*nix" when referring to both UNIX and Linux.

UNIX time

Use instead of "epoch time".

upsert

Don't use. Instead, clarify the action by writing something such as, "Inserts rows if the rows don't exist, or updates rows if they do exist".

URI, URL

Use "URI" or "URL" when referring to the respective string type. Choose the most specific initialism for your scenario. See also URN.

URN

Don't use. Use "URI" instead.

user base

Use as 2 words.

username

Use as 1 word in written text. If "user name" appears as 2 words in the UI, write "user name" as 2 words in the documentation to match.

utilize

Don't use. Use "use".

V

v

Spell out "version" instead of abbreviating with a "v".

Do this

Splunk platform versions 6.6.x and 7.0.x

very

Don't use.

vetted

Don't use. Use "approved".

via

Don't use. Use "by using" or "through". Don't use Latin abbreviations or terms.

vice versa

Don't use. Use "and the reverse". Don't use Latin abbreviations or terms.

vice-versa

Don't use. Use "and the reverse". Don't use Latin abbreviations or terms.

view

Use when describing the UI. Don't use "see".

Do this

Use this chart to view the percentage of crashes.

View app usage.

visit

Don't use in the context of internet sites. Use "go to", "navigate to", or another phrase.

vs.

Don't use. Spell out "versus" or use another phrase. Don't use Latin abbreviations or terms.

W

warning

Don't use as type of callout box. A warning indicates danger or bodily harm and appears in hardware documentation. See Best practices for using callout boxes.

web

Lowercase unless it is part of a proper name, like Splunk Web or World Wide Web.

when

Use to indicate an action, behavior, or event that is expected or certain to occur. This term implies a cause-and-effect relationship. See also after and if.

Do this

When a signal crosses the static threshold, an alert is triggered.

Don't do this

After a signal crosses the static threshold, an alert is triggered.

If a signal crosses the static threshold, an alert is triggered.

whether or not

Don't use. Use "whether".

whitelist

Don't use. Use "allow list" as a noun and "allow" or "include" as a verb. For a single item, use "allow rule" or "allow entry". There are additional synonyms you can use in specific situations. "Allow" refers to access, "accept" refers to validity, and "include" refers to inclusion. For IP traffic, for example, "allow" is suitable. For files or rules, "include" might be more specific. See also blacklist.

Do this

Set up an allow list to include specific incoming data.

Don't do this

Whitelist the specific incoming data.

wildcarded

Don't use. Use "wildcard" with an asterisk in parentheses after the term to denote the search action of matching characters in string values. See also Show symbols in text.

Do this

You can use a wildcard ( * ) to match noninternal indexes in searches.

Don't do this

Indexes in searches can be wildcarded, although * matches only noninternal indexes.

wish

Don't use. Use "want".

wizard

Avoid using this term. Use only if you need to refer to the UI component and the label contains the word "wizard". If you must refer to the general component, use "guided setup" sparingly. Always aim to describe the user's actions and goals instead of the components and features of the product. See A word about Splunk docs for more information.

Do this

In Splunk Web, select Add Data to start getting data in.

Select App Wizard to design and develop an app framework.

Follow the step-by-step process provided in the Splunk Observability Cloud guided setup.

Don't do this

Use the Add Data wizard in Splunk Web.

Follow the step-by-step process provided in the Splunk Observability Cloud wizard.

would

Don't use. Avoid subjunctive mood. Write in the indicative or imperative mood instead. See Write in indicative or imperative mood.

X

x (HTTP status codes)

Use a lowercase "x" to represent a range of HTTP status codes.

Do this

4xx

The value of the span's status code tag is set to 5xx.

Don't do this

4XX

The value of the span's status code tag is set to 5XX.

x (version number in releases)

Use a lowercase "x" at the relevant place in the version number when referring to maintenance builds, minor versions, or releases for a product. Don't include a "v" before the number.

Do this

Splunk Enterprise 7.x

Splunk platform versions 6.6.x and 7.0.x

Don't do this

Splunk platform v5.0.x

Splunk platform version 7.1.X