Splunk® Style Guide

Splunk Style Guide

Acrobat logo Download manual as PDF


The guidelines in the Splunk Style Guide establish best practices for writing technical documentation. Search docs.splunk.com to find documentation related to Splunk products.
Acrobat logo Download topic as PDF

Usage dictionary

The following list outlines terms to use and avoid in Splunk documentation.

*

*nix
Use to refer to both UNIX and Linux together. If only 1 system is supported, use "UNIX" or "Linux". See *nix in the Splexicon.

A

abnormal
Don't use. Use "atypical" or "not typical".
abort
Don't use unless referring to a specific command or system language. Otherwise, use "force quit", "cancel", "fail", "close", "stop", "end", or another term that accurately reflects the situation.
above
Don't use to refer to a location in a document. Directional or visual instructions are unhelpful to visually impaired users. Use "higher" to refer to versions of software. Use "earlier" or "previous" to refer to page elements. See higher, earlier, and previous.
ad hoc
Use only when referring to an unscheduled search, otherwise don't use Latin abbreviations or terms. Don't use any other term for a search that a user launches manually. In references not about an unscheduled search, use "if needed". See ad hoc search in the Splexicon.
add-on
Include a hyphen. The plural form is "add-ons". The term takes a definite article. You can write it as "the add-on" after the first instance of the full name of the add-on. Use "add-on" when writing about a Technical Add-on, Supported Add-on, or Domain Add-on in Splunk docs. See add-on in the Splexicon.
Do this
add-on
the add-on
the Splunk Add-on for [name of third-party vendor]
Don't do this
add-On
Add-On
addon
AddOn
after
Use to denote a chronological sequence of events that doesn't rely on cause and effect. Don't use to mean "when". See also when.
Do this
After you install the update, save your changes.
Don't do this
After a user logs in to your organization, a SessionLog event is created.
allows you to
Avoid this phrase. Focus on the goals a user can achieve with their product rather than what the product lets a user do.
AM
Write with capital letters and without periods. Use to mean between midnight and 11:59 in the morning when writing the time of day. See 12-hour clock.
and/or
Don't use. Pick the word that best fits the sentence.
anti
Don't include a hyphen.
Do this
antivirus
app
Use to refer to an application that runs on the Splunk platform. See app in the Splexicon.
at present
Don't use. Use "now".
at this point
Don't use.
auto
Don't include a hyphen.
Do this
autodiscover
autoscale
Don't do this
auto-discover
auto discover
auto-scale

B

back end, back-end
Use as 2 words when used as a noun. Include a hyphen when used as an adjective. Don't use if you can find a more specific term, such as server, operating system, database, network, and the like.
backend
Don't use.
base directories
Put the variable name for a directory in all capital letters regardless of the operating system. If the variable name has spaces, replace the spaces with the underscore ( _ ) character.
For *nix, precede the base directory with a dollar sign ( $ ). For Windows, surround the base directory with percent signs ( % ).
*nix
$SPLUNK_HOME
Windows
%SPLUNK_HOME%
basic steps
Don't use. Use "steps".
below
Don't use to refer to a location in a document. Directional or visual instructions are unhelpful to visually impaired users. Use "lower" to refer to versions of software. Use "following", "later", or "next" to refer to page elements. See lower, following, later, and next.
blacklist
Don't use. Use "deny list" as a noun and "deny" as a verb. There are additional synonyms you can use in specific situations: "deny" refers to access, "reject" refers to validity, and "exclude" refers to inclusion. For IP traffic, for example, "deny" is suitable. For files or rules, "exclude" might be more specific. See also whitelist.
Do this
Deny the incoming data.
Set up a deny list to exclude specific incoming data.
Don't do this
Blacklist the specific incoming data.
Set up a blacklist to exclude specific incoming data.
Boolean
The term for the logical operator that takes one of two values, generally True and False. Always capitalize.
bulletproof
Don't use. Use "safe", "secure", "solid", "impenetrable", or another unambiguous term.

C

can not
Don't use as 2 words. Use "can't" or "cannot".
can
Use to mean ability.
capability
A user action within the Splunk platform. Use this term to refer to Splunk role-based access controls (RBAC). See capability in the Splexicon. Don't use to refer to the functionality or features of a product. See functionality and feature.
Do this
Each role contains at least 1 capability. Capabilities define what users who hold a certain role can do.
Don't do this
The latest release of Splunk Enterprise Security has the following new capabilities.
case sensitive, case-sensitive
Don't include a hyphen when you write the term after the noun that it modifies. Include a hyphen when you write the term before the noun that it modifies.
Do this
the password is case sensitive
a case-sensitive username
Don't do this
the password is case-sensitive
a case sensitive username
check box
Use as 2 words. Write "check or uncheck a check box", or "select or deselect a check box".
check out
Don't use. Use "see".
click
Don't use. Use "select". Avoid terms that are specific to certain devices and input methods. For more information, see select.
choose
Don't use when referring to UI selections. Use "select".
comma separated, comma-separated
Don't include a hyphen when you write the term after the noun that it modifies. Include a hyphen when you write the term before the noun that it modifies.
Do this
the list is comma separated
a comma-separated list
Don't do this
the list is comma-separated
a comma separated list
command line, command-line
Use as 2 words when used as a noun. Include a hyphen when used as an adjective.
Do this
from the command line
command-line interface
command-line tool
Don't do this
from the command-line
command line interface
command line tool
.conf file
Use lowercase letters with a period in front or spell out "configuration file". See configuration file in the Splexicon.
Do this
.conf file
configuration file
Don't do this
conf file
CONF file
could
Don't use. Use "can". Avoid subjunctive mood. See Write in indicative or imperative mood.

D

DA
The abbreviation for Domain Add-on. Don't use DA when you write about the product. Use "add-on". It's okay to use "DA" in a file or path. See add-on.
dark mode
Don't use. Use "dark theme".
dark theme
Use lowercase letters when writing generally about the color contrast choice that a user can select for their UI. Don't use "dark mode". Follow the capitalization used in the UI.
Do this
You can choose to view Splunk Web in a light theme or a dark theme.
In the SPL Editor, select Themes, and then Light Theme or Dark Theme.
Don't do this
You can view Splunk Web in a Dark Theme.
View Splunk Web in dark mode.
data
Use as a singular mass noun. Write "data is" rather than "data are", and use "less data" rather than "fewer data". Don't use "datum".
Do this
Data transfer is complete.
The data includes weblogs, call center logs, and order system logs.
Set this parameter if you want to backfill less data than the retention period.
Don't do this
The data aren't visible.
The summary page has fewer data than the source index.
The datum includes syslogs.
data model, datamodel
Use as 2 words when referring to a knowledge object. See data model in the Splexicon. Use as 1 word when used as a search command.
data point
Use as 2 words.
database
Use as 1 word.
dataset
Use as 1 word. See dataset in the Splexicon.
datum
Don't use.
demonstrate
Don't use. Use "show" to mean illustrating or explaining with examples.
deploy
Use to mean the process of setting up the components for a partial or entire system, which can include installing and configuring software and hardware. Use "install" to mean installing a piece of software. See also install.
Do this
Deploy a multisite indexer cluster.
You can deploy forwarders in a wide variety of scenarios.
Don't do this
Deploy the Splunk Enterprise .tgz file.
You can deploy the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.
desire
Don't use. Use "want" to show hope for or to express a need.
Do this
Edit the stanzas to collect the data you want to view.
Don't do this
Edit the stanzas to collect the data you desire.
dialog box
Use as 2 words without "ue".
Do this
In the dialog box
Don't do this
In the dialog
In the dialogue
In the dialogue box
dialogue
Include "ue" when referring to a conversation.
directory
See file path.
disable, disabled, disables
Don't use. Choose a plain-language alternative that describes the action or state, such as "deactivate", "deactivated", "deactivates", "deselect", "deselected", "deselects", "hide", "hidden", "hides", "inactive", "turn off", "turned off", "turns off", "unavailable", "makes unavailable", or the like. See also enable.
double-check
Don't use. Use "check" or "make sure".
do not
Use as 2 words when the emphasis is on "not". Otherwise, it's okay to use "don't". See Contractions.
drag-and-drop
Use as an adjective. For a verb use "drag", which implies drop.
drill down, drilldown
Use as 2 words as a verb. Use as 1 word without a hyphen as a noun, adjective, or interactive functionality. See drilldown in the Splexicon.
drop-down
Use only when necessary for clarity. Don't use as a noun. Include "list" with the title of the list for context.
dummy data
Don't use. Use "placeholder data".

E

earlier
Don't use to refer to versions of software. Use "lower". It's okay to use "earlier" to refer to parts of documentation or page elements that precede a user's current location, such as "See <link to section> earlier in this topic". See also previous.
e.g.
Don't use. Spell out "for example". Don't use Latin abbreviations or terms.
enable, enabled, enables
Don't use to show the counteraction of turning off a feature, deactivating a feature, or describing a deactivated feature. Choose a logical plain-language alternative that explains the action or state, such as "activate", "activated", "activates", "select", "selected", "selects", "show", "shows", "turn on", "turned on", "turns on", or the like. See also disable.
enables you to
Avoid this phrase. Focus on the goals a user can achieve with their product rather than what the product lets a user do.
endpoint
Use as 1 word.
enter
Use as a verb to refer to inputting text. Don't use "type" because there are multiple ways to enter text. For more information, see Use device-agnostic language.
Do this
Enter your name.
Enter a password value.
Enter your search in the search bar.
Don't do this
Type your name.
Type a password value.
Type your search in the search bar.
epoch time
Don't use. Use "UNIX time".
etc.
Don't use Latin abbreviations or terms. Be specific and concrete when you write.
execute
Don't use. Use "run".
Experience
Use to refer to a named Experience such as Victoria Experience or Classic Experience. Always capitalize. Don't include a definite article. Use with the preposition "on" when describing how to use an Experience or its components.
Do this
Experience capabilities differ depending on your Experience designation.
Splunk Cloud Platform deployments on Victoria Experience support self-service app installation of private apps and most public apps.
In the About panel, find your Experience: Classic or Victoria.
Don't do this
The Experience capabilities differ depending on the Experience designation.
This feature is supported in Victoria Experience.
Navigate to the About panel to determine your experience.

F

fail over, failover
Use as 2 words when written as a verb. Use as 1 word when written as a noun or adjective.
fatal
Don't use. Use "unrecoverable" or another unambiguous term.
feature
A piece of code shipped with a product that provides a tool a user can use to complete a task or action. Generally, this term is best used in release notes to describe updates to a product release. Avoid documenting features and instead put the emphasis on how a user can achieve their goal. Don't use to refer to the capabilities or functionality of a product. See capability and functionality.
Do this
Version 5.1.0 of the Splunk Add-on for AWS version contains the following new features.
fetch
Don't use. Use "retrieve".
field-value pair
Include a hyphen between "field" and "value" when they modify the word "pair".
Do this
field-value pair
Don't do this
field/value pair
field value pair
file name
Use as 2 words.
file name extensions
The suffix appended to a specific file. Put in lowercase letters. See also file types.
Do this
Update the stanza in indexes.conf.
Upload the upload.json file.
Enlarge the workflow.jpg image.
Create a file named tar-exmpl-2023.tar.
The manual downloads as alert_actions.pdf.
Distribute the file that ends in .splunkconfig.
Don't do this
Update the stanza in the conf file.
Upload the Upload json file.
Enlarge the workflow .jpg.
Create a compressed .tgz archive file.
The manual downloads as alert_actions.PDF.
Send the fat_cats.GIF to the entire team.
file path
A unique location in a file system. Use as 2 words. Don't use "filepath". For *nix, use a forward slash ( / ). For Windows, use a backslash ( \ ). When writing instructions, list both the *nix and Windows file paths, in that order.
*nix
$SPLUNK_HOME/bin/splunkd
Windows
%SPLUNK_HOME%\bin\splunkd.exe
Use angle brackets to indicate parts of a file path that differ by user or operating system, such as /home/<username>/.login. See Brackets.
file system
Use as 2 words. Don't use "filesystem".
file types
The term used for a file category, such as Portable Document Format (PDF) documents or Graphics Interchange Format (GIF) files. Use a file type when you write about a broad file category. It's okay to shorten the file type as an acronym or initialism. Capitalize the acronym or initialism when it's used as an adjective or when it stands alone in text. An exception to the standard styling for file types is for configuration files (.conf files) which are styled like a file name extension. See also file name extensions and .conf file.
Do this
The upload must be in JSON format.
Upload photos as JPG files.
Download the topic as a PDF.
Save the export as a CSV file.
The TAR file can have a .tar, .tar.gz, or .tgz extension.
Update the stanza in the .conf file.
Don't do this
The upload must be a .json.
Upload photos as jpegs.
Download the topic as a pdf.
Save the export as a .CSV.
The TAR file can have a TAR, .tar.GZ, or .TGZ extension.
Update the stanza in the CONF file.
filename
Don't use. Use "file name".
filepath
Don't use. Use "file path".
filesystem
Don't use.
first-class entity
Don't use. Use "top-level entity".
flesh-colored
Don't use terminology that assumes race to describe color. Use the most accurate word to describe the color.
following
Use to refer to parts of documentation or page elements that immediately come after a user's current location, such as "in the following section" or "in the following table". See also later and next.
for instance
Don't use. Use "for example".
front end, front-end
Use as 2 words when written as a noun. Include a hyphen when written as an adjective. Don't use if you can find a more specific term, such as the name of the product, feature, app, and the like.
functionality
Use this term to describe how Splunk product features work. Don't use to refer to the capabilities or features of a product. See capability and feature.
Do this
The following update provides new functionality in the custom visualizations framework.
Don't do this
Dashboards are a functionality of Splunk Cloud Platform.

G

grandfathered
Don't use. Use "exempt".


H

hangs
Don't use. Use "stops responding" or "freezes" based on the situation.
hard-code, hard-coded, hard-coding
Use only for a technical or developer audience when referring to coding values and functions directly into the source code rather than obtaining values from general input or external sources. Include a hyphen.
have been
Don't use. Use "are".
have knowledge of
Don't use. Use "know".
have the option to
Don't use. Use "can".
he, him, his
Don't use in documentation. Use "they", "them", their", "a user", "the users", or another inclusive term. See Gender-neutral pronouns.
hex
Write out "hexadecimal". Don't abbreviate.
higher
Use to refer to versions of software. Don't use "later".
hit
Don't use. Use "select", "enter", or another device-agnostic term.
home page
Use as 2 words. Don't use "homepage".
host name
Use as 2 words. Don't use "hostname".
homepage
Don't use. Use "home page".
hostname
Don't use. Use "host name".
hover over
Use to describe the action of positioning the pointer over a UI item. Include the preposition "over". 

I

i.e.
Don't use. Spell out "in other words". Don't use Latin abbreviations or terms.
if
Use to indicate a hypothetical situation, a possibility, or a condition that must be met for a particular action, behavior, or event to occur. See also when.
Do this
If the search returns too many results, try refining your search.
Don't do this
When the search returns too many results, try refining your search.
if you want to
Don't use in a task step. Use "(Optional)" to indicate the step is optional. See Formatting task steps in Numbered lists.
illegal characters
Don't use. Use "invalid characters".
important
Don't use as a note tag or in a callout box. See Best practices for using callout boxes.
install
Use as a verb, not as a noun. Use to mean installing a piece of software. Use "deploy" to describe the process of setting up the components for a partial or entire system, which can include installing and configuring software and hardware. See also deploy.
Do this
Install the Splunk Enterprise .tgz file.
You can install the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.
Don't do this
Deploy the Splunk Enterprise .tgz file.
You can deploy the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.
instance
Use to refer to a Splunk Enterprise instance. Use the full phrase "Splunk Enterprise instance" on the first use in the topic or section. See machine and server.
internet
Lowercase, unless it is the first word in a sentence or part of a proper noun, such as Internet Explorer. Always use with a definite article, such as "the internet".
into
Use as 1 word in the context of getting data into a Splunk product.
Do this
Get data into Splunk User Behavior Analytics.
Don't do this
Get data in to Splunk User Behavior Analytics.
is able to
Don't use. Use "can".
it is recommended
Don't use. Rewrite to make a statement about what the customer must do. See Treat Splunk documentation as a recommendation.

J

JSON
Use as a modifier, not as a standalone term. Choose the most precise noun based on the context.
Do this
the JSON format
the JSON schema
the JSON representation
the JSON attribute
Don't do this
the JSON
just
Don't use.

K

kill
Use only when referring to the *nix command or process. Otherwise, use "quit", "stop", or "end" based on the situation.
key-value pair
Include a hyphen. Don't use a slash or space. Don't use the phrase "key value" on its own.
Do this
key-value pair
Don't do this
key value
key/value pair
keyboard characters
The core section of keys on a keyboard. Special keyboard characters, such as the at symbol ( @ ), pipe ( | ), and forward slash ( / ) , aren't standardized on international keyboards. Be explicit when referring to special keyboard characters. See Show symbols in text.

L

later
Don't use to refer to versions of software. Use "higher". It's okay to use "later" to refer to parts of documentation or page elements that follow a user's current location, such as "See <link to section> later in this topic". See also following and next.
latest
Use to refer to the latest versions of browsers and SaaS.
launch
Don't use. Use "open" to mean starting an operation or to set in motion. It's okay to use "launch" to match the UI.
Do this
Uncheck the Launch browser with Splunk check box to prevent your browser from opening.
Don't do this
Start Splunk Enterprise and launch Splunk Web.
Place a shortcut on your desktop to launch Splunk Enterprise.
left
Don't use to refer to a location in a document. Use "earlier" or "previous". Directional or visual instructions are unhelpful to visually impaired users, and locations of elements can change depending on the device being used to read the content. See earlier or previous.
lets you
Avoid this phrase. Focus on the goals a user can achieve with their product rather than what the product lets a user do.
leverage
Don't use. Use "use".
light mode
Do not use. Use "light theme".
light theme
Use lowercase letters when writing generally about the color contrast choice that a user can select for their UI. Follow the capitalization used in the UI when writing about a button or other component in the Splunk product UI.
Do this
You can choose to view Splunk Web in a light theme or a dark theme.
In the SPL Editor, select Themes, and then Light Theme or Dark Theme.
Don't do this
You can view Splunk Web in a Light Theme.
line break
The point where a line of text ends and a new line starts. Use as 2 words without a hyphen. Don't refer to a forced line break as a "carriage return".
Linux
Use "Linux" if only Linux is supported. Write "*nix" when referring to both Linux and UNIX.
log in
Use as 2 words as a verb. Follow with "to" to describe entering a username or password for a system. Use "as" to describe entering with a specific role or privileges. Don't use "log on".
Do this
Log in to Splunk Web.
Log in as an administrator.
Don't do this
Log into Splunk Web.
Login to Splunk Web.
Log on as an administrator.
log off
Don't use. Use "log out".
log on
Don't use. Use "log in".
log out
Use as a verb. Don't use "log off".
login
Use as 1 word as a noun or adjective. Don't use "logon".
Do this
The login interface is easy to use.
Don't do this
The log in password is "changeme".
The logon password is "changeme".
logoff
Don't use. Use "log out".
logon
Don't use. Use "log in".
logout
Don't use as 1 word. Use "log out".
long press
If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "select and hold" instead of "long press". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "long press".
look up
Use as 2 words as a verb.
Do this
Set the CSV lookup to look up the host.
Don't do this
Set the CSV lookup to lookup the host.
lookup
Use as 1 word as a noun, adjective, or knowledge object. See lookup in the Splexicon.
lower
Use to refer to versions of software. Don't use "earlier".

M

machine
Use to refer to the virtual or physical machine that the instance runs on. See instance and server.
mankind
Don't use. Use "all", "everyone", "humanity", "humankind", or another inclusive term.
master
Don't use. Use "manager" for the centralized management, leading, or coordinating node, and when you discuss the relationship of that node with other nodes that interact with it. See manager node in the Splexicon.
Do this
License manager
Indexer cluster manager node
Don't do this
License master
Indexer cluster master node
master branch
Don't use. Use "main branch".
may
Use only to mean permission. Use "might" for possibility or "can" for ability.
metadata
Use as a singular mass noun. Write "metadata is" rather than "metadata are". See also data.
Do this
Metadata lets users find, filter, and aggregate metric time series and other objects.
Select the link targets for this trigger if the metadata is visible.
Don't do this
The metadata are written to data files.
The metadata include the key name, value, and start and end time.
MFA
Spell out multifactor authentication. Don't use MFA as an abbreviation.
might
Use to mean possibility.
modal
Don't use. Use "dialog box".
more
Use when referring to an icon with 3 horizontal dots (Horizontal version of the more icon.) or 3 vertical dots ( Vertical version of the more icon. ) in a Splunk GUI. Don't capitalize. Include an inline image of the icon when possible.
Do this
Select the more icon ( Vertical version of the more icon. ).
Don't do this
Select the more button ( Vertical version of the more icon. ).
Select the more icon (Horizontal version of the more icon.).
Select the More icon (Horizontal version of the more icon.).
mouse over
Don't use. Use "hover over".
multi
Don't include a hyphen.
Do this
multiserver
multisite
multivalue
Don't do this
multi-server
multi-site
multi-value
multivalued field
Don't use. Use "multivalue field". See multivalue field in the Splexicon.

N

n/a
Write in lowercase letters. Use only in tables or lists to refer to a value that is not applicable or not available. Spell out instead of abbreviating when used in paragraph text.
Do this
n/a
Don't do this
N/A
N.A.
NA
needle-in-a-haystack
Don't use. Find a plain language alternative, like "hard-to-find".
Do this
Troubleshoot a hard-to-find case by searching for a specific trace.
Don't do this
Troubleshoot a needle-in-a-haystack case by searching for a specific trace.
next
Use to refer to parts of documentation or page elements that immediately follow a user's current location in a topic, such as "in the next section". See also following and later.
non
Don't include a hyphen.
Do this
nonzero
note that
Don't use in text. Consider whether using a note callout box is more effective. See Best practices for using callout boxes.
null
Write in lowercase letters to refer to an empty value, the null Search Processing Language (SPL) command, or when null appears in SPL search results.

O

on-premises
Include a hyphen and treat "premises" as plural. Don't use "on premise", "on-premise", "on prem", or "on-prem".
Do this
If your Splunk platform deployment is installed on-premises, you can...
A deployment that uses an on-premises search head...
For on-premises Splunk Enterprise instances only.
Don't do this
A deployment that uses an on-premise search head...
On-the-premises in a server room
Running Splunk Enterprise on-prem
once
Use when you mean 1 time and no more. Don't use to mean "after" or "when". See also after and when.
only
Place immediately before or after the word or phrase it modifies.
Do this
The sdselect command supports only the required arguments for the tonumber() and tostring() functions.
Don't do this
The sdselect command only supports the required arguments for the tonumber() and tostring() functions.
out-of-the-box
Don't use. Find a plain language alternative, such as "default" or "prepackaged".

P

path name, pathname
Don't use. Use "path".
percent
Use a numeral followed by the percent sign ( % ) to specify an exact percentage. Don't use the word "percent".
Do this
10%
Don't do this
Ten percent
10 percent
percentage
Use as a noun when not specifying an exact quantity.
perform
Don't use in the context of searches or other commands. Use "run".
pinch
If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "zoom out" instead of "pinch". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "pinch".
please
Don't use.
plug in, plugin
Write as 2 words without a hyphen when you use this term as a verb. Write as 1 word without a hyphen when you use this term as a noun or adjective.
plug-in
Don't use.
PM
Write with capital letters and without periods. Use to mean between noon and 11:59 in the evening when writing the time of day. See 12-hour clock.
point to
Don't use. Use "hover over".
preconfigured
Don't use. Use "configured".
premium apps
Don't use. Use the name of the app instead or describe the apps in another way.
Premium Solutions
Don't use. Use the name of the app instead or describe the apps in another way.
press
Don't use. Use "select" for the action of keying in characters on a keyboard or activating a button.
previous
Use to refer to parts of documentation or page elements that immediately precede a user's current location, such as "in the previous section". See also earlier.

Q

query
Use when referring to a SQL command or a database. Don't use to refer to a Splunk search. See also search.
Do this
database query
SQL query
Don't do this
Splunk query
SPL query
write a query to generate a single value visualization
quite
Don't use.

R

radio button
Don't use "radio" without following it with a noun.
read-only
Include a hyphen. Use as an adjective.
Do this
The file is read-only.
Read-only memory stores information that can be read, but not modified.
Don't do this
The readonly file.
The file is read only.
Read only memory stores information that can be read, but not modified.
read/write, read/write/delete
Use the forward slash instead of a hyphen when you write about read, write, and delete permissions.
Do this
Add read/write permissions for all users.
The role restricts read/write/delete permissions.
Don't do this
Add read-write permissions for all users.
Add read and/or write permissions for all users.
real time, real-time
Use as 2 words when used as a noun. Include a hyphen when used as an adjective.
Do this
Perform the search in real time.
real-time alert
Don't do this
Perform the search in real-time.
Perform the search in realtime.
real time alert
realtime
Don't use.
really
Don't use.
reboot
Don't use. Use "restart". It's okay to use "reboot" when it appears in a command.
recommend
Don't use. Rewrite to state what the customer must do. See Treat Splunk documentation as a recommendation.
reenable
Don't include a hyphen. Or rewrite as "enable again".
reenter
Don't include a hyphen. Or rewrite as "enter again".
regex
Write out "regular expression". Don't use any other variation or abbreviation.
rerun
Don't use. Use "run the search again". Use "again" only if it is necessary for clarity.
right
Don't use to refer to a location in a document. Directional or visual instructions are unhelpful to visually impaired users. See Avoid directional or visual language.
run
Use in the context of searches or other commands. Don't use "execute" or "perform".
Do this
Run the search.
Don't do this
Execute the search.
Perform the search.
runtime
Use as 1 word as a noun or adjective. Don't use "run time" or "run-time".
Do this
runtime considerations
the total runtime
Don't do this
run-time considerations
the total run time

S

(s), (es)
Don't write a lowercase "s" or "es" in parentheses after a noun to indicate both singular and plural. Choose the best option for your sentence. In most cases, using the plural works best for understanding. See also Plurals in parentheses.
SA
The abbreviation for Supporting Add-on. Don't use "SA" when you write about the product. Use "add-on". It's okay to use "SA" in a file or path. See add-on.
sanity check
Don't use. Use "review" or "verification".
search
Use to refer to a Splunk search. Don't use query. See also query. See search in the Splexicon.
Do this
Splunk search
write a search to generate a single value visualization
run a search
Don't do this
Splunk query
write a query to generate a single value visualization
see
Use for references and cross-references. Don't use "check out". To describe the UI, use "view" instead. See view.
Example
For an introduction to forwarders, see About forwarding and receiving.
select
Use to highlight text, choose menu items, go to a link, push a button, open a tab, check a check box, or interact with a keyboard. Don't use "click" or "press". For more information, see Use device-agnostic language.
Do this
Select the link.
Select Esc.
Select Patterns.
Don't do this
Click the link.
Press Esc.
Click Patterns.
select and hold
Use this term to cover the multiple ways a user can interact with a touch-based interface. If you must specify the user's gesture in order to perform an action on a mobile device, you can use "long press".
server
Because the term "server" is used in the IT industry to refer both to a type of software and the machine that the software runs on, avoid this term. Be clear when you refer to the Splunk platform. Use "instance" in the Splunk platform context and "machine" for the virtual or physical machine the instance runs on. See instance and machine.
she, her, hers
Don't use in documentation. Use "they", "them", their", "a user", "the users", or another inclusive term. See Gender-neutral pronouns.
should
Don't use. Avoid the subjunctive mood, and use imperative or indicative mood instead. See Write in indicative or imperative mood.
shows up
Don't use. Use "appears".
sign in
Don't use. See log in.
sign on
Don't use. See log in.
simply
Don't use.
slave
Don't use. Use "peer" for nodes that interact with the centralized management, leading, or coordinating node.
Do this
License peer
Indexer cluster peer node
Don't do this
License slave
source type, sourcetype
Use as 1 word when referring to the field name. Use as 2 words in all other instances. See source type in the Splexicon.
space-separated
Include a hyphen when used as an adjective.
Do this
A space-separated list
Don't do this
A space separated list
specify
Don't use in task steps. Use "select" or "enter".
specifically
Don't use.
spin up, spin down
Don't use. Use "start" and "stop" or the most descriptive action for the virtual machine.
Splunk
When used alone, use "Splunk" to refer only to the company, not to any product. Don't use in the possessive form. See Splunk product terminology.
Do this
Splunk has a mascot called Buttercup.
a Splunk customer
Splunk.com account
Configure Splunk software
Restart the Splunk platform.
the Splunk universal forwarder
Don't do this
a Splunk account
Configure your Splunk.
Restart Splunk.
Splunk's universal forwarder
Splunk Cloud Platform
Use as a proper noun to refer to the software, spelled with initial capital letters. Don't include a definite article, use as a possessive, or shorten the name using an acronym or abbreviation. See Splunk product terminology.
Do this
Splunk Cloud Platform
Don't do this
The Splunk Cloud Platform
Splunk Cloud platform
Splunk Cloud
SCP
Splunk Cloud Platform's features
Splunk Developer Portal
Use as a proper noun to refer to https://dev.splunk.com, spelled with initial capital letters and using a definite article. Don't use abbreviations or acronyms in place of this term. Don't confuse this term with the Splunk Developer Program.
Do this
See the Splunk Developer Portal.
Don't do this
See Splunk Developer Portal.
See the Splunk dev portal.
See SDP.
Splunk Developer Program
Don't use in documentation. This term refers to the program containing developer offerings like services, tooling, and the Splunk Developer Portal. Don't confuse this term with the Splunk Developer Portal itself, which refers to https://dev.splunk.com.
Splunk Enterprise
Use as a proper noun to refer to the software, spelled with initial capital letters. Don't include a definite article or use as a possessive. See Splunk product terminology.
Do this
Splunk Enterprise
Don't do this
The Splunk Enterprise
Splunk Enterprise platform
Splunk Enterprise's features
Splunk Observability Cloud
Use to refer to the product suite. Don't omit "Splunk" or use an acryonym to shorten the name. Don't include a definite article or use as a possessive. Don't refer to the suite as a platform. See Splunk product terminology.
Do this
Splunk Observability Cloud
Don't do this
Observability Cloud
SOC
The Splunk Observability Cloud
Splunk Observability Cloud platform
Splunk Observability Cloud's features
the Splunk platform
Use to refer to both Splunk Cloud Platform and Splunk Enterprise. Don't capitalize "platform" or use as a possessive. Include a definite article in most cases. Use as a modifier when writing about an instance, a deployment, or an environment when you're describing multiple platform products. See Splunk product terminology.
Do this
the Splunk platform
a Splunk platform instance
your Splunk platform deployment
version 7.2.4 of the Splunk platform
Don't do this
Splunk Platform
the Splunk platform's features
Splunk server instance
a Splunk instance
Splunk software
Use to refer to any combination of Splunk Enterprise, Splunk Cloud Platform, any Splunk-supported apps and add-ons, and any other software produced by Splunk. Don't capitalize "software" or use it as a possessive. See Splunk product terminology.
Do this
Splunk software
Don't do this
Splunk Software
Splunk Software instance
Splunk software's features
Splunk Support Portal
Use to refer to the portal where customers with a support contract can get assistance from Splunk Customer Support. Capitalize the initial letters.
Splunk UI
Use only in reference to the product called Splunk UI. For all other cases, use "Splunk Web".
Splunk Web
Use to refer to the graphical user interface for the Splunk platform. See Splunk Web in the Splexicon.
Do this
Splunk Web
Don't do this
SplunkWeb
a Splunk UI
the Splunk UI
Splunk Web UI
Web UI
Web Interface
splunkd
Use when referring specifically to the Splunk Enterprise process, the service that is installed with Splunk Enterprise on Windows machines, or a service used to manage the splunkd process on Linux machines. Don't use in place of Splunk Enterprise or the Splunk platform. See splunkd in the Splexicon.
Do this
Splunk Enterprise installs a process called splunkd on your host.
Configure systemd to manage splunkd as a service.
Don't do this
After installing the add-on, restart splunkd.
spread
If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "zoom in" instead of "spread". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "spread".
SSH
Don't use as a verb.
Do this
Log in to the instance using SSH.
Use Secure Shell (SSH) to log in to the instance.
Don't do this
SSH into the instance.
stack
Use only in specific cases where the word "stack" is used, like in the name of a CLI command or an API. Don't use to refer to a Splunk Cloud Platform deployment.
Do this
Use the add-stack command to configure a Splunk Cloud Platform deployment.
Don't do this
Splunk Cloud Platform stack
standalone
Write as 1 word with no hyphen. Use this term only as an adjective.
Do this
a standalone instance
Don't do this
a stand alone instance
a stand-alone instance
suicide mode
Don't use. Use "time until restart" or another unambiguous term.
switch or switch component
Use as a noun to describe the moveable slider bar in the UI that switches between on and off states. It's okay to say "switch", "switch component", "toggle", or "toggle switch".

T

takes you to
Don't use. Use "open".
TA
The abbreviation for Technology Add-on. Don't use "TA" when you write about the product. Use "add-on". It is okay to use "TA" in a file or path. See add-on.
tap
If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "select" instead of "tap". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "tap".
tarball
Don't use. Use "TAR file".
The purpose of this document is...
Don't use. Rewrite to be user-focused. See User-focused in A word about Splunk docs.
This document describes...
Don't use. Rewrite to be user-focused. See User-focused in A word about Splunk docs.
This topic describes...
Don't use. Rewrite to be user-focused. See User-focused in A word about Splunk docs.
thus
Don't use.
time series, time-series
Use as 2 words when used as a noun. Include a hyphen when used as an adjective. See time series in the Splexicon.
timeseries
Don't use. Use "time series" as a noun or "time-series" as an adjective.
toggle or toggle switch
Use as a verb to describe moving a switch component between on and off states. Use as a noun to describe the moveable slider bar in the UI that switches between on and off states. It's okay to also call it a "switch", "switch component", or "toggle switch".
type
Don't use to describe user input. Avoid terms that are specific to certain devices and input methods. Use "enter" instead. See enter.

U

UNIX
Use "UNIX" if only UNIX is supported. Write "*nix" when referring to both UNIX and Linux.
UNIX time
Use instead of "epoch time".
upsert
Don't use. Instead, clarify the action by writing something such as, "Inserts rows if the rows don't exist, or updates rows if they do exist".
URI, URL
Use "URI" or "URL" when referring to the respective string type. Choose the most specific initialism for your scenario. See also URN.
URN
Don't use. Use "URI" instead.
user base
Use as 2 words.
username
Use as 1 word in written text. If "user name" appears as 2 words in the UI, write "user name" as 2 words in the documentation to match.
utilize
Don't use. Use "use".

V

v
Spell out "version" instead of abbreviating with a "v".
Do this
Splunk platform versions 6.6.x and 7.0.x
very
Don't use.
vetted
Don't use. Use "approved".
via
Don't use. Use "by using" or "through". Don't use Latin abbreviations or terms.
vice versa
Don't use. Use "and the reverse". Don't use Latin abbreviations or terms.
vice-versa
Don't use. Use "and the reverse". Don't use Latin abbreviations or terms.
view
Use when describing the UI. Don't use "see".
Do this
Use this chart to view the percentage of crashes.
View app usage.
visit
Don't use in the context of internet sites. Use "go to", "navigate to", or another phrase.
vs.
Don't use. Spell out "versus" or use another phrase. Don't use Latin abbreviations or terms.

W

warning
Don't use as type of callout box. A warning indicates danger or bodily harm and appears in hardware documentation. See Best practices for using callout boxes.
web
Lowercase unless it is part of a proper name, like Splunk Web or World Wide Web.
when
Use to indicate an action, behavior, or event that is expected or certain to occur. This term implies a cause-and-effect relationship. See also after and if.
Do this
When a signal crosses the static threshold, an alert is triggered.
Don't do this
After a signal crosses the static threshold, an alert is triggered.
If a signal crosses the static threshold, an alert is triggered.
whether or not
Don't use. Use "whether".
whitelist
Don't use. Use "allow list" as a noun and "allow" or "include" as a verb. For a single item, use "allow rule" or "allow entry". There are additional synonyms you can use in specific situations. "Allow" refers to access, "accept" refers to validity, and "include" refers to inclusion. For IP traffic, for example, "allow" is suitable. For files or rules, "include" might be more specific. See also blacklist.
Do this
Set up an allow list to include specific incoming data.
Don't do this
Whitelist the specific incoming data.
wildcarded
Don't use. Use "wildcard" with an asterisk in parentheses after the term to denote the search action of matching characters in string values. See also Show symbols in text.
Do this
You can use a wildcard ( * ) to match noninternal indexes in searches.
Don't do this
Indexes in searches can be wildcarded, although * matches only noninternal indexes.
wish
Don't use. Use "want".
wizard
Avoid using this term. Use only if you need to refer to the UI component and the label contains the word "wizard". If you must refer to the general component, use "guided setup" sparingly. Always aim to describe the user's actions and goals instead of the components and features of the product. See A word about Splunk docs for more information.
Do this
In Splunk Web, select Add Data to start getting data in.
Select App Wizard to design and develop an app framework.
Follow the step-by-step process provided in the Splunk Observability Cloud guided setup.
Don't do this
Use the Add Data wizard in Splunk Web.
Follow the step-by-step process provided in the Splunk Observability Cloud wizard.
would
Don't use. Avoid subjunctive mood. Write in the indicative or imperative mood instead. See Write in indicative or imperative mood.

X

x (HTTP status codes)
Use a lowercase "x" to represent a range of HTTP status codes.
Do this
4xx
The value of the span's status code tag is set to 5xx.
Don't do this
4XX
The value of the span's status code tag is set to 5XX.
x (version number in releases)
Use a lowercase "x" at the relevant place in the version number when referring to maintenance builds, minor versions, or releases for a product. Don't include a "v" before the number.
Do this
Splunk Enterprise 7.x
Splunk platform versions 6.6.x and 7.0.x
Don't do this
Splunk platform v5.0.x
Splunk platform version 7.1.X
Last modified on 08 February, 2024
PREVIOUS
A word about Splunk docs
  NEXT
Splunk voice and tone

This documentation applies to the following versions of Splunk® Style Guide: current, current


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters