Usage dictionary

The following list outlines terms to use and avoid in Splunk documentation.

*

*nix

Use to refer to both UNIX and Linux together. If only 1 system is supported, use "UNIX" or "Linux". See *nix in the Splexicon.

A

abnormal

Don't use. See atypical or not typical.

abort

Don't use unless referring to a specific command or system language. Otherwise, use "force quit", "cancel", "fail", "close", "stop", "end", or another term that accurately reflects the situation.

above

Don't use to refer to a location in a document. Directional or visual instructions are unhelpful to visually impaired users. Use "higher" to refer to versions of software. Use "earlier" or "previous" to refer to page elements. See higher, earlier, and previous.

ad hoc

Use only when referring to an unscheduled search, otherwise don't use Latin abbreviations or terms. See ad hoc search in the Splexicon. Don't use any other term for a search that a user launches manually. In references not about an unscheduled search, see if needed.

add-on

Include a hyphen. The plural form is "add-ons". The term takes a definite article. You can write it as "the add-on" after the first instance of the full name of the add-on. Use "add-on" when writing about a Technical Add-on, Supported Add-on, or Domain Add-on in Splunk docs. See add-on in the Splexicon.

Do this

add-on

the add-on

the Splunk Add-on for [name of third-party vendor]

Don't do this

add-On

Add-On

addon

AddOn

admin, administrator

For the most part, use "admin" as an adjective to identify the role-based access control label and "administrator" as a noun to identify a user's job title or responsibility. Don't capitalize.

Do this

You must be assigned the admin role to add members.

As a Splunk administrator, you must onboard new members in your team.

Don't do this

You must be an admin to add members.

You must be a Splunk Admin to onboard new members in your team.

after

Use to denote a chronological sequence of events that doesn't rely on cause and effect. Don't use to mean "when". See when.

Do this

After you install the update, save your changes.

Don't do this

After a user logs in to your organization, a SessionLog event is created.

allow, allow entry, allow list, allow rule

Instead of "whitelist", use "allow" as a verb and "allow list" as a noun. For a single item, use "allow rule" or "allow entry".

allows you to

Avoid this phrase. Focus on the goals a user can achieve with their product rather than what the product lets a user do.

AM

Write with capital letters and without periods. Use to mean between midnight and 11:59 in the morning when writing the time of day. See 12-hour clock.

and/or

Don't use. Pick the word that best fits the sentence.

and the reverse

Use instead of "vice versa" or "vice-versa".

anti

Don't include a hyphen.

Do this

antivirus

app

Use to refer to an application that runs on the Splunk platform. See app in the Splexicon.

appears

Use instead of "shows up".

approved

Use instead of "vetted".

are

Use instead of "have been".

at present

Don't use. See now.

at this point

Don't use.

atypical

Use instead of "abnormal".

auto

Don't include a hyphen.

Do this

autodiscover

autoscale

Don't do this

auto-discover

auto discover

auto-scale

B

back end, back-end

Use as 2 words when used as a noun. Include a hyphen when used as an adjective. Don't use if you can find a more specific term, such as server, operating system, database, network, and the like.

backend

Don't use.

base directories

Put the variable name for a directory in all capital letters regardless of the operating system. If the variable name has spaces, replace the spaces with the underscore ( _ ) character.

For *nix, precede the base directory with a dollar sign ( $ ). For Windows, surround the base directory with percent signs ( % ).

*nix

$SPLUNK_HOME

Windows

%SPLUNK_HOME%

below

Don't use to refer to a location in a document. Directional or visual instructions are unhelpful to visually impaired users. Use "lower" to refer to versions of software. Use "following", "later", or "next" to refer to page elements. See lower, following, later, and next.

blacklist

Don't use. Use "deny list" as a noun and "deny" as a verb. See deny, deny list. There are additional synonyms you can use in specific situations: "deny" refers to access, "reject" refers to validity, and "exclude" refers to inclusion. For IP traffic, for example, "deny" is suitable. For files or rules, "exclude" might be more specific. See also whitelist.

Do this

Deny the incoming data.

Set up a deny list to exclude specific incoming data.

Don't do this

Blacklist the specific incoming data.

Set up a blacklist to exclude specific incoming data.

Boolean

The term for the logical operator that takes one of two values, generally True and False. Always capitalize.

bulletproof

Don't use. Use "safe", "secure", or another unambiguous term. See safe and secure.

by using

Use instead of "via".

C

can

Use to mean ability instead of "have the option to" or "is able to".

can't, cannot

Use as 1 word instead of "can not".

can not

Don't use as 2 words. See can't, cannot.

capability

A user action within the Splunk platform. Use this term to refer to Splunk role-based access controls (RBAC). See capability in the Splexicon. Don't use to refer to the functionality or features of a product. See functionality and feature.

Do this

Each role contains at least 1 capability. Capabilities define what users who hold a certain role can do.

Don't do this

The latest release of Splunk Enterprise Security has the following new capabilities.

case sensitive, case-sensitive

Don't include a hyphen when you write the term after the noun that it modifies. Include a hyphen when you write the term before the noun that it modifies.

Do this

the password is case sensitive

a case-sensitive username

Don't do this

the password is case-sensitive

a case sensitive username

check

When used to mean verify, use instead of "double-check".

check box

Use as 2 words. Write "check or uncheck a check box", or "select or deselect a check box".

check out

Don't use. Use "see".

click

Don't use. Use "select". Avoid terms that are specific to certain devices and input methods. For more information, see select.

choose

Don't use when referring to UI selections. Use "select".

comma separated, comma-separated

Don't include a hyphen when you write the term after the noun that it modifies. Include a hyphen when you write the term before the noun that it modifies.

Do this

the list is comma separated

a comma-separated list

Don't do this

the list is comma-separated

a comma separated list

command line, command-line

Use as 2 words when used as a noun. Include a hyphen when used as an adjective.

Do this

from the command line

command-line interface

command-line tool

Don't do this

from the command-line

command line interface

command line tool

.conf file

Use lowercase letters with a period in front or spell out "configuration file". See configuration file in the Splexicon.

Do this

.conf file

configuration file

Don't do this

conf file

CONF file

configured

Use instead of "preconfigured".

could

Don't use. Use "can". Avoid subjunctive mood. See Write in indicative or imperative mood.

D

DA

The abbreviation for Domain Add-on. Don't use DA when you write about the product. Use "add-on". It's okay to use "DA" in a file or path. See add-on.

dark mode

Don't use. Use "dark theme".

dark theme

Use lowercase letters when writing generally about the color contrast choice that a user can select for their UI. Don't use "dark mode". Follow the capitalization used in the UI.

Do this

You can choose to view Splunk Web in a light theme or a dark theme.

In the SPL Editor, select Themes, and then Light Theme or Dark Theme.

Don't do this

You can view Splunk Web in a Dark Theme.

View Splunk Web in dark mode.

data

Use as a singular mass noun. Write "data is" rather than "data are", and use "less data" rather than "fewer data". Don't use "datum".

Do this

Data transfer is complete.

The data includes weblogs, call center logs, and order system logs.

Set this parameter if you want to backfill less data than the retention period.

Don't do this

The data aren't visible.

The summary page has fewer data than the source index.

The datum includes syslogs.

data model, datamodel

Use as 2 words when referring to a knowledge object. See data model in the Splexicon. Use as 1 word when used as a search command.

data point

Use as 2 words.

database

Use as 1 word.

dataset

Use as 1 word. See dataset in the Splexicon.

datum

Don't use.

default

Use instead of "out-of-the-box".

demonstrate

Don't use. See show.

deny, denylist

Instead of "blacklist", use "deny" as a verb and "deny list" as a noun.

deploy

Use to mean the process of setting up the components for a partial or entire system, which can include installing and configuring software and hardware. Use "install" to mean installing a piece of software. See also install.

Do this

Deploy a multisite indexer cluster.

You can deploy forwarders in a wide variety of scenarios.

Don't do this

Deploy the Splunk Enterprise .tgz file.

You can deploy the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.

desire

Don't use. See want.

Do this

Edit the stanzas to collect the data you want to view.

Don't do this

Edit the stanzas to collect the data you desire.

dialog box

Use as 2 words without "ue".

Do this

In the dialog box

Don't do this

In the dialog

In the dialogue

In the dialogue box

dialogue

Include "ue" when referring to a conversation.

directory

Use when discussing file system structures in a CLI context or when addressing developers who work with file structures programmatically. For CLI contexts, don't use "folder", which is typically used in GUI contexts. See folder.

Do this

Use the ./splunk add command and specify a directory for data ingestion to configure network inputs.

If you need to discuss both CLI and GUI options, use language that ensures users understand the terminology interchangeably.

disable, disabled, disables

Don't use. Choose a plain-language alternative that describes the action or state, such as "deactivate", "deactivated", "deactivates", "deselect", "deselected", "deselects", "hide", "hidden", "hides", "inactive", "turn off", "turned off", "turns off", "unavailable", "makes unavailable", or the like. See also enable.

double-check

Don't use. See check or make sure.

do not

Use as 2 words when the emphasis is on "not". Otherwise, it's okay to use "don't". See Contractions.

drag-and-drop

Use as an adjective. For a verb use "drag", which implies drop.

drill down, drilldown

Use as 2 words as a verb. Use as 1 word without a hyphen as a noun, adjective, or interactive functionality. See drilldown in the Splexicon.

drop-down

Use as an adjective. Include a noun, such as "menu" or "list", after "drop-down".

dummy data

Don't use. See placeholder data.

E

earlier

Don't use to refer to versions of software. Use "lower". It's okay to use "earlier" to refer to parts of documentation or page elements that precede a user's current location, such as "See <link to section> earlier in this topic". See also previous.

e.g.

Don't use Latin abbreviations or terms. See for example.

enable, enabled, enables

Don't use to show the counteraction of turning off a feature, deactivating a feature, or describing a deactivated feature. Choose a logical plain-language alternative that explains the action or state, such as "activate", "activated", "activates", "select", "selected", "selects", "show", "shows", "turn on", "turned on", "turns on", or the like. See also disable.

enable again

Use instead of "re-enable".

enables you to

Avoid this phrase. Focus on the goals a user can achieve with their product rather than what the product lets a user do.

endpoint

Use as 1 word.

enter

Use as a verb to refer to inputting text. Don't use "specify". Don't use "type" because there are multiple ways to enter text. For more information, see Use device-agnostic language.

Do this

Enter your name.

Enter a password value.

Enter your search in the search bar.

Don't do this

Type your name.

Type a password value.

Type your search in the search bar.

enter again

Use instead of "re-enter".

epoch time

Don't use. Use "UNIX time".

etc.

Don't use Latin abbreviations or terms. Be specific and concrete when you write.

ex.

Don't use common abbreviations in place of precise language. See for example.

execute

Don't use. Use "run".

exempt

Use instead of "grandfathered".

Experience

Use to refer to a named Experience such as Victoria Experience or Classic Experience. Always capitalize. Don't include a definite article. Use with the preposition "on" when describing how to use an Experience or its components.

Do this

Experience capabilities differ depending on your Experience designation.

Splunk Cloud Platform deployments on Victoria Experience support self-service app installation of private apps and most public apps.

In the About panel, find your Experience: Classic or Victoria.

Don't do this

The Experience capabilities differ depending on the Experience designation.

This feature is supported in Victoria Experience.

Navigate to the About panel to determine your experience.

F

fail over, failover

Use as 2 words when written as a verb. Use as 1 word when written as a noun or adjective.

fatal

Don't use. See unrecoverable or choose another unambiguous term.

feature

A piece of code shipped with a product that provides a tool a user can use to complete a task or action. Generally, this term is best used in release notes to describe updates to a product release. Avoid documenting features and instead put the emphasis on how a user can achieve their goal. Don't use to refer to the capabilities or functionality of a product. See capability and functionality.

Do this

Version 5.1.0 of the Splunk Add-on for AWS version contains the following new features.

fetch

Don't use. See retrieve.

field-value pair

Include a hyphen between "field" and "value" when they modify the word "pair".

Do this

field-value pair

Don't do this

field/value pair

field value pair

file name

Use as 2 words.

file name extensions

The suffix appended to a specific file. Put in lowercase letters. See also file types.

Do this

Update the stanza in indexes.conf.

Upload the upload.json file.

Enlarge the workflow.jpg image.

Create a file named tar-exmpl-2023.tar.

The manual downloads as alert_actions.pdf.

Distribute the file that ends in .splunkconfig.

Don't do this

Update the stanza in the conf file.

Upload the Upload json file.

Enlarge the workflow .jpg.

Create a compressed .tgz archive file.

The manual downloads as alert_actions.PDF.

Send the fat_cats.GIF to the entire team.

file path

A path that describes a location in a file system structure. Use as 2 words. Don't use "filepath". When writing out file paths, use a forward slash ( / ) for *nix and a backslash ( \ ) for Windows. List both the *nix and Windows file paths, in that order.

*nix

$SPLUNK_HOME/bin/splunkd

Windows

%SPLUNK_HOME%\bin\splunkd.exe

Use angle brackets to indicate parts of a file path that differ by user or operating system, such as /home/<username>/.login. See Brackets.

file system

Use as 2 words. Don't use "filesystem".

file types

The term used for a file category, such as Portable Document Format (PDF) documents or Graphics Interchange Format (GIF) files. Use a file type when you write about a broad file category. It's okay to shorten the file type as an acronym or initialism. Capitalize the acronym or initialism when it's used as an adjective or when it stands alone in text. An exception to the standard styling for file types is for configuration files (.conf files) which are styled like a file name extension. See also file name extensions and .conf file.

Do this

The upload must be in JSON format.

Upload photos as JPG files.

Download the topic as a PDF.

Save the export as a CSV file.

The TAR file can have a .tar, .tar.gz, or .tgz extension.

Update the stanza in the .conf file.

Don't do this

The upload must be a .json.

Upload photos as jpegs.

Download the topic as a pdf.

Save the export as a .CSV.

The TAR file can have a TAR, .tar.GZ, or .TGZ extension.

Update the stanza in the CONF file.

filename

Don't use. Use "file name".

filepath

Don't use. Use "file path".

filesystem

Don't use. See file system.

first-class entity

Don't use. See top-level entity.

flesh-colored

Don't use terminology that assumes race to describe color. Use the most accurate word to describe the color.

folder

Use when referring to file system structures in a GUI context. For GUI contexts, don't use "directory", which is typically used in CLI contexts. See directory.

Do this

Remove the existing Splunk_TA_Windows folder from $SPLUNK_HOME/etc/shcluster/apps.

If you need to discuss both CLI and GUI options, use language that ensures users understand the terminology interchangeably.

following

Use to refer to parts of documentation or page elements that immediately come after a user's current location, such as "in the following section" or "in the following table". See also later and next.

for example

Use instead of "e.g.", "ex.", or "for instance".

for instance

Don't use. See for example.

freezes

Use instead of "hangs".

front end, front-end

Use as 2 words when written as a noun. Include a hyphen when written as an adjective. Don't use if you can find a more specific term, such as the name of the product, feature, app, and the like.

functionality

Use this term to describe how Splunk product features work. Don't use to refer to the capabilities or features of a product. See capability and feature.

Do this

The following update provides new functionality in the custom visualizations framework.

Don't do this

Dashboards are a functionality of Splunk Cloud Platform.

G

grandfathered

Don't use. See exempt.

H

hangs

Don't use. See stops responding or freezes.

hard-code, hard-coded, hard-coding

Use only for a technical or developer audience when referring to coding values and functions directly into the source code rather than obtaining values from general input or external sources. Include a hyphen.

hard-to-find

Use instead of "needle-in-a-haystack".

have been

Don't use. See are.

have knowledge of

Don't use. See know.

have the option to

Don't use. See can.

he, him, his

Don't use in documentation. Use "they", "them", their", "a user", "the users", or another inclusive term. See Gender-neutral pronouns.

hex

Write out "hexadecimal". Don't abbreviate.

higher

Use to refer to versions of software. Don't use "later".

hit

Don't use. Use "select", "enter", or another device-agnostic term.

home page

Use as 2 words. Don't use "homepage".

host name

Use as 2 words. Don't use "hostname".

homepage

Don't use. Use "home page".

hostname

Don't use. Use "host name".

hover over

Use instead of "point to" or "mouse over" to describe the action of positioning the pointer over a UI item.

I

i.e.

Don't use Latin abbreviations or terms. See in other words.

if

Use to indicate a hypothetical situation, a possibility, or a condition that must be met for a particular action, behavior, or event to occur. See also when.

Do this

If the search returns too many results, try refining your search.

Don't do this

When the search returns too many results, try refining your search.

if needed

Use instead of "ad hoc".

if you want to

Don't use in a task step. Use "(Optional)" to indicate the step is optional. See Formatting task steps in Numbered lists.

illegal characters

Don't use. See invalid characters.

important

Don't use as a note tag or in a callout box. See Best practices for using callout boxes.

in other words

Use instead of "i.e.".

include

Use as a verb instead of "whitelist".

install

Use as a verb, not as a noun. Use to mean installing a piece of software. Use "deploy" to describe the process of setting up the components for a partial or entire system, which can include installing and configuring software and hardware. See also deploy.

Do this

Install the Splunk Enterprise .tgz file.

You can install the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.

Don't do this

Deploy the Splunk Enterprise .tgz file.

You can deploy the Splunk Add-on for Microsoft Office 365 with Splunk Web or from the command line.

instance

Use to refer to a Splunk Enterprise instance. Use the full phrase "Splunk Enterprise instance" on the first use in the topic or section. See machine and server.

internet

Lowercase, unless it is the first word in a sentence or part of a proper noun, such as Internet Explorer. Always use with a definite article, such as "the internet".

into

Use as 1 word in the context of getting data into a Splunk product.

Do this

Get data into Splunk User Behavior Analytics.

Don't do this

Get data in to Splunk User Behavior Analytics.

invalid characters

Use instead of "illegal characters".

is able to

Don't use. See can.

it is recommended

Don't use. Rewrite to make a statement about what the customer must do. See Treat Splunk documentation as a recommendation.

J

JSON

Use as a modifier, not as a standalone term. Choose the most precise noun based on the context.

Do this

the JSON format

the JSON schema

the JSON representation

the JSON attribute

Don't do this

the JSON

just

Don't use.

K

kill

Use only when referring to the *nix command or process. Otherwise, use "quit", "stop", or "end" based on the situation.

key-value pair

Include a hyphen. Don't use a slash or space. Don't use the phrase "key value" on its own.

Do this

key-value pair

Don't do this

key value

key/value pair

keyboard characters

The core section of keys on a keyboard. Special keyboard characters, such as the at symbol ( @ ), pipe ( | ), and forward slash ( / ) , aren't standardized on international keyboards. Be explicit when referring to special keyboard characters. See Show symbols in text.

know

Use instead of "have knowledge of".

L

later

Don't use to refer to versions of software. Use "higher". It's okay to use "later" to refer to parts of documentation or page elements that follow a user's current location, such as "See <link to section> later in this topic". See also following and next.

latest

Use to refer to the latest versions of browsers and SaaS.

launch

It's okay to use "launch" to match a UI, otherwise see open.

Do this

Uncheck the Launch browser with Splunk check box to prevent your browser from opening.

Don't do this

Start Splunk Enterprise and launch Splunk Web.

Place a shortcut on your desktop to launch Splunk Enterprise.

left

Don't use to refer to a location in a document. Use "earlier" or "previous". Directional or visual instructions are unhelpful to visually impaired users, and locations of elements can change depending on the device being used to read the content. See earlier or previous.

lets you

Avoid this phrase. Focus on the goals a user can achieve with their product rather than what the product lets a user do.

leverage

Don't use. See use.

light mode

Do not use. Use "light theme".

light theme

Use lowercase letters when writing generally about the color contrast choice that a user can select for their UI. Follow the capitalization used in the UI when writing about a button or other component in the Splunk product UI.

Do this

You can choose to view Splunk Web in a light theme or a dark theme.

In the SPL Editor, select Themes, and then Light Theme or Dark Theme.

Don't do this

You can view Splunk Web in a Light Theme.

line break

The point where a line of text ends and a new line starts. Use as 2 words without a hyphen. Don't refer to a forced line break as a "carriage return".

Linux

Use "Linux" if only Linux is supported. Write "*nix" when referring to both Linux and UNIX.

log in

Use as 2 words as a verb. Follow with "to" to describe entering a username or password for a system. Use "as" to describe entering with a specific role or privileges. Don't use "log on".

Do this

Log in to Splunk Web.

Log in as an administrator.

Don't do this

Log into Splunk Web.

Login to Splunk Web.

Log on as an administrator.

log off

Don't use. Use "log out".

log on

Don't use. Use "log in".

log out

Use as a verb. Don't use "log off".

login

Use as 1 word as a noun or adjective. Don't use "logon".

Do this

The login interface is easy to use.

Don't do this

The log in password is "changeme".

The logon password is "changeme".

logoff

Don't use. Use "log out".

logon

Don't use. Use "log in".

logout

Don't use as 1 word. Use "log out".

long press

If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "select and hold" instead of "long press". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "long press".

look up

Use as 2 words as a verb.

Do this

Set the CSV lookup to look up the host.

Don't do this

Set the CSV lookup to lookup the host.

lookup

Use as 1 word as a noun, adjective, or knowledge object. See lookup in the Splexicon.

lower

Use to refer to versions of software. Don't use "earlier".

M

machine

Use to refer to the virtual or physical machine that the instance runs on. See instance and server.

main branch

Use instead of "master branch".

make sure

Use instead of "double-check".

manager

Use instead of "master".

mankind

Don't use. Use "all", "everyone", "humanity", "humankind", or another inclusive term.

master

Don't use. Use "manager" for the centralized management, leading, or coordinating node, and when you discuss the relationship of that node with other nodes that interact with it. See manager and manager node in the Splexicon.

Do this

License manager

Indexer cluster manager node

Don't do this

License master

Indexer cluster master node

master branch

Don't use. See main branch.

may

Use only to mean permission. Use "might" for possibility or "can" for ability.

metadata

Use as a singular mass noun. Write "metadata is" rather than "metadata are". See also data.

Do this

Metadata lets users find, filter, and aggregate metric time series and other objects.

Select the link targets for this trigger if the metadata is visible.

Don't do this

The metadata are written to data files.

The metadata include the key name, value, and start and end time.

MFA

Don't use. See multifactor authentication.

might

Use to mean possibility.

modal

Don't use. Use "dialog box". See dialog box.

more

Use when referring to an icon with 3 horizontal dots () or 3 vertical dots ( ) in a Splunk GUI. Don't capitalize. Include an inline image of the icon when possible.

Do this

Select the more icon ( ).

Don't do this

Select the more button ( ).

Select the more icon ().

Select the More icon ().

mouse over

Don't use. See hover over.

multi

Don't include a hyphen in words that begin with the prefix "multi".

Do this

multiserver

multisite

multivalue

Don't do this

multi-server

multi-site

multi-value

multifactor authentication

Spell out the phrase instead of using the abbreviation "MFA".

multivalue field

Use instead of "multivalued field". See multivalue field in the Splexicon.

multivalued field

Don't use. See multivalue field.

N

n/a

Write in lowercase letters. Use only in tables or lists to refer to a value that is not applicable or not available. Spell out instead of abbreviating when used in paragraph text.

Do this

n/a

Don't do this

N/A

N.A.

NA

needle-in-a-haystack

Don't use. See hard-to-find.

Do this

Troubleshoot a hard-to-find case by searching for a specific trace.

Don't do this

Troubleshoot a needle-in-a-haystack case by searching for a specific trace.

next

Use to refer to parts of documentation or page elements that immediately follow a user's current location in a topic, such as "in the next section". See also following and later.

non

Don't include a hyphen.

Do this

nonzero

not typical

Use instead of "abnormal".

note that

Don't use in text. Consider whether using a note callout box is more effective. See Best practices for using callout boxes.

now

Use instead of "at present".

null

Write in lowercase letters to refer to an empty value, the null Search Processing Language (SPL) command, or when null appears in SPL search results.

O

on prem, on-prem

Don't use. See on-premises.

on premise, on-premise

Don't use. See on-premises.

on-premises

Include a hyphen and treat "premises" as plural. Use instead of "on premise", "on-premise", "on prem", or "on-prem".

Do this

If your Splunk platform deployment is installed on-premises, you can...

A deployment that uses an on-premises search head...

For on-premises Splunk Enterprise instances only.

Don't do this

A deployment that uses an on-premise search head...

On-the-premises in a server room

Running Splunk Enterprise on-prem

once

Use when you mean 1 time and no more. Don't use to mean "after" or "when". See also after and when.

only

Place immediately before or after the word or phrase it modifies. See Misplaced modifiers.

Do this

The sdselect command supports only the required arguments for the tonumber() and tostring() functions.

Don't do this

The sdselect command only supports the required arguments for the tonumber() and tostring() functions.

open

Use instead of "takes you to" or "launch".

out-of-the-box

Don't use. See default or prepackaged.

P

path

Use instead of "path name" or "pathname".

path name, pathname

Don't use. See path.

percent

Use a numeral followed by the percent sign ( % ) to specify an exact percentage. Don't use the word "percent".

Do this

10%

Don't do this

Ten percent

10 percent

peer

Use instead of "slave".

percentage

Use as a noun when not specifying an exact quantity.

perform

Don't use in the context of searches or other commands. Use "run".

pinch

If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "zoom out" instead of "pinch". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "pinch".

placeholder data

Use instead of "dummy data".

please

Don't use.

plug in, plugin

Write as 2 words without a hyphen when you use this term as a verb. Write as 1 word without a hyphen when you use this term as a noun or adjective.

plug-in

Don't use.

PM

Write with capital letters and without periods. Use to mean between noon and 11:59 in the evening when writing the time of day. See 12-hour clock.

point to

Don't use. See hover over.

pop-up

Don't use. Use "dialog box". See dialog box.

preconfigured

Don't use. See configured.

premium apps

Don't use. Use the name of the app instead or describe the apps in another way.

Premium Solutions

Don't use. Use the name of the app instead or describe the apps in another way.

prepackaged

Use instead of "out-of-the-box".

press

Don't use. Use "select" for the action of keying in characters on a keyboard or activating a button.

previous

Use to refer to parts of documentation or page elements that immediately precede a user's current location, such as "in the previous section". See also earlier.

Q

query

Use when referring to a SQL command or a database. Don't use to refer to a Splunk search. See also search.

Do this

database query

SQL query

Don't do this

Splunk query

SPL query

write a query to generate a single value visualization

quite

Don't use.

R

radio button

Don't use "radio" without following it with a noun.

read-only

Include a hyphen. Use as an adjective.

Do this

The file is read-only.

Read-only memory stores information that can be read, but not modified.

Don't do this

The readonly file.

The file is read only.

Read only memory stores information that can be read, but not modified.

read/write, read/write/delete

Use the forward slash instead of a hyphen when you write about read, write, and delete permissions.

Do this

Add read/write permissions for all users.

The role restricts read/write/delete permissions.

Don't do this

Add read-write permissions for all users.

Add read and/or write permissions for all users.

real time, real-time

Use as 2 words when used as a noun. Include a hyphen when used as an adjective.

Do this

Perform the search in real time.

real-time alert

Don't do this

Perform the search in real-time.

Perform the search in realtime.

real time alert

realtime

Don't use.

really

Don't use.

reboot

It's okay to use "reboot" when it appears in a command, otherwise don't use. See restart.

recommend

Don't use. Rewrite to state what the customer must do. See Treat Splunk documentation as a recommendation.

reenable

Don't include a hyphen or rewrite as "enable again". See enable again.

reenter

Don't include a hyphen or rewrite as "enter again". See enter again.

regex

Don't use. See regular expression.

regular expression

Use instead of "regex".

rerun

Don't use. See run the search again.

restart

Use instead of "reboot".

retrieve

Use instead of "fetch".

review

Use instead of "sanity check".

right

Don't use to refer to a location in a document. Directional or visual instructions are unhelpful to visually impaired users. See Avoid directional or visual language.

run

Use in the context of searches or other commands. Don't use "execute" or "perform".

Do this

Run the search.

Don't do this

Execute the search.

Perform the search.

run the search again

Use instead of "rerun". Use "again" only if it is necessary for clarity.

runtime

Use as 1 word as a noun or adjective. Don't use "run time" or "run-time".

Do this

runtime considerations

the total runtime

Don't do this

run-time considerations

the total run time

S

(s), (es)

Don't write a lowercase "s" or "es" in parentheses after a noun to indicate both singular and plural. Choose the best option for your sentence. In most cases, using the plural works best for understanding. See also Plurals in parentheses.

SA

The abbreviation for Supporting Add-on. Don't use "SA" when you write about the product. Use "add-on". It's okay to use "SA" in a file or path. See add-on.

safe

Use instead of "bulletproof".

sanity check

Don't use. See review or verification.

scroll

Don't use. Use "read", "skim", or another device-agnostic verb that describes the intended action. See Use device-agnostic language.

search

Use to refer to a Splunk search. Don't use query. See also query. See search in the Splexicon.

Do this

Splunk search

write a search to generate a single value visualization

run a search

Don't do this

Splunk query

write a query to generate a single value visualization

secure

Use instead of "bulletproof".

see

Use for references and cross-references. Don't use "check out". To describe the UI, use "view" instead. See view.

Example

For an introduction to forwarders, see About forwarding and receiving.

select

Use to highlight text, choose menu items, go to a link, push a button, open a tab, check a check box, or interact with a keyboard. Don't use "specify", "click", or "press". For more information, see Use device-agnostic language.

Do this

Select the link.

Select Esc.

Select Patterns.

Don't do this

Click the link.

Press Esc.

Click Patterns.

select and hold

Use this term to cover the multiple ways a user can interact with a touch-based interface. If you must specify the user's gesture in order to perform an action on a mobile device, you can use "long press".

server

Because the term "server" is used in the IT industry to refer both to a type of software and the machine that the software runs on, avoid this term. Be clear when you refer to the Splunk platform. Use "instance" in the Splunk platform context and "machine" for the virtual or physical machine the instance runs on. See instance and machine.

she, her, hers

Don't use in documentation. Use "they", "them", their", "a user", "the users", or another inclusive term. See Gender-neutral pronouns.

should

Don't use. Avoid the subjunctive mood, and use imperative or indicative mood instead. See Write in indicative or imperative mood.

show

Use instead to mean illustrating or explaining with examples.

shows up

Don't use. See appears.

sign in

Don't use. See log in.

sign on

Don't use. See log in.

simply

Don't use.

slave

Don't use. Use "peer" for nodes that interact with the centralized management, leading, or coordinating node. See peer.

Do this

License peer

Indexer cluster peer node

Don't do this

License slave

source type, sourcetype

Use as 1 word when referring to the field name. Use as 2 words in all other instances. See source type in the Splexicon.

space-separated

Include a hyphen when used as an adjective.

Do this

A space-separated list

Don't do this

A space separated list

specify

Don't use in task steps. See select or enter.

specifically

Don't use.

spin up, spin down

Don't use. See start and stop or use the most descriptive action for the virtual machine.

Splunk

When used alone, use "Splunk" to refer only to the company, not to any product. Don't use in the possessive form. See Splunk product terminology.

Do this

Splunk has a mascot called Buttercup.

a Splunk customer

Splunk.com account

Configure Splunk software

Restart the Splunk platform.

the Splunk universal forwarder

Don't do this

a Splunk account

Configure your Splunk.

Restart Splunk.

Splunk's universal forwarder

Splunk Cloud Platform

Use as a proper noun to refer to the software, spelled with initial capital letters. Don't include a definite article, use as a possessive, or shorten the name using an acronym or abbreviation. See Splunk product terminology.

Do this

Splunk Cloud Platform

Don't do this

The Splunk Cloud Platform

Splunk Cloud platform

Splunk Cloud

SCP

Splunk Cloud Platform's features

Splunk Developer Portal

Use as a proper noun to refer to https://dev.splunk.com, spelled with initial capital letters and using a definite article. Don't use abbreviations or acronyms in place of this term. Don't confuse this term with the Splunk Developer Program.

Do this

See the Splunk Developer Portal.

Don't do this

See Splunk Developer Portal.

See the Splunk dev portal.

See SDP.

Splunk Developer Program

Don't use in documentation. This term refers to the program containing developer offerings like services, tooling, and the Splunk Developer Portal. Don't confuse this term with the Splunk Developer Portal itself, which refers to https://dev.splunk.com.

Splunk Enterprise

Use as a proper noun to refer to the software, spelled with initial capital letters. Don't include a definite article or use as a possessive. See Splunk product terminology.

Do this

Splunk Enterprise

Don't do this

The Splunk Enterprise

Splunk Enterprise platform

Splunk Enterprise's features

Splunk Observability Cloud

Use to refer to the product suite. Don't omit "Splunk" or use an acronym to shorten the name. Don't include a definite article or use as a possessive. Don't refer to the suite as a platform. See Splunk product terminology.

Do this

Splunk Observability Cloud

Don't do this

Observability Cloud

SOC

The Splunk Observability Cloud

Splunk Observability Cloud platform

Splunk Observability Cloud's features

the Splunk platform

Use to refer to both Splunk Cloud Platform and Splunk Enterprise. Don't capitalize "platform" or use as a possessive. Include a definite article in most cases. Use as a modifier when writing about an instance, a deployment, or an environment when you're describing multiple platform products. See Splunk product terminology.

Do this

the Splunk platform

a Splunk platform instance

your Splunk platform deployment

version 7.2.4 of the Splunk platform

Don't do this

Splunk Platform

the Splunk platform's features

Splunk server instance

a Splunk instance

Splunk software

Use to refer to any combination of Splunk Enterprise, Splunk Cloud Platform, any Splunk-supported apps and add-ons, and any other software produced by Splunk. Don't capitalize "software" or use it as a possessive. See Splunk product terminology.

Do this

Splunk software

Don't do this

Splunk Software

Splunk Software instance

Splunk software's features

Splunk Support Portal

Use to refer to the portal where customers with a support contract can get assistance from Splunk Customer Support. Capitalize the initial letters.

Splunk UI

Use only in reference to the product called Splunk UI. For all other cases, use "Splunk Web".

Splunk Web

Use to refer to the graphical user interface for the Splunk platform. See Splunk Web in the Splexicon.

Do this

Splunk Web

Don't do this

SplunkWeb

a Splunk UI

the Splunk UI

Splunk Web UI

Web UI

Web Interface

splunkd

Use when referring specifically to the Splunk Enterprise process, the service that is installed with Splunk Enterprise on Windows machines, or a service used to manage the splunkd process on Linux machines. Don't use in place of Splunk Enterprise or the Splunk platform. See splunkd in the Splexicon.

Do this

Splunk Enterprise installs a process called splunkd on your host.

Configure systemd to manage splunkd as a service.

Don't do this

After installing the add-on, restart splunkd.

spread

If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "zoom in" instead of "spread". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "spread".

SSH

Don't use as a verb.

Do this

Log in to the instance using SSH.

Use Secure Shell (SSH) to log in to the instance.

Don't do this

SSH into the instance.

stack

Use only in specific cases where the word "stack" is used, like in the name of a CLI command or an API. Don't use to refer to a Splunk Cloud Platform deployment.

Do this

Use the add-stack command to configure a Splunk Cloud Platform deployment.

Don't do this

Splunk Cloud Platform stack

standalone

Write as 1 word with no hyphen. Use this term only as an adjective.

Do this

a standalone instance

Don't do this

a stand alone instance

a stand-alone instance

start

Use instead of "spin up".

stop

Use instead of "spin down".

stops responding

Use instead of "hangs".

suicide mode

Don't use. See time until restart or choose another unambiguous term.

switch or switch component

Use as a noun to describe the moveable slider bar in the UI that switches between on and off states. It's okay to say "switch", "switch component", "toggle", or "toggle switch".

sync, synchronize

Use instead of "synch".

synch

Don't use. See sync, synchronize.

T

TA

The abbreviation for Technology Add-on. Don't use "TA" when you write about the product. Use "add-on". It is okay to use "TA" in a file or path. See add-on.

takes you to

Don't use. See open.

tap

If there are multiple ways a user can interact with a touch-based interface, use an input-agnostic term such as "select" instead of "tap". If you must specify the user's gesture in order to perform an action on a mobile device, you can use "tap".

tarball

Don't use. See TAR file.

TAR file

Use instead of "tarball".

The purpose of this document is...

Don't use. Rewrite to be user-focused. See User-focused in A word about Splunk docs.

This document describes...

Don't use. Rewrite to be user-focused. See User-focused in A word about Splunk docs.

This topic describes...

Don't use. Rewrite to be user-focused. See User-focused in A word about Splunk docs.

through

Use instead of "via".

thus

Don't use.

timeseries

Don't use. Use "time series" as a noun or "time-series" as an adjective.

time series, time-series

Use as 2 words when used as a noun. Include a hyphen when used as an adjective. See time series in the Splexicon.

time until restart

Use instead of "suicide mode".

toggle or toggle switch

Use as a verb to describe moving a switch component between on and off states. Use as a noun to describe the moveable slider bar in the UI that switches between on and off states. It's okay to also call it a "switch", "switch component", or "toggle switch".

top-level entity

Use instead of "first-class entity".

type

Don't use to describe user input. Avoid terms that are specific to certain devices and input methods. Use "enter" instead. See enter.

U

UNIX

Use "UNIX" if only UNIX is supported. Write "*nix" when referring to both UNIX and Linux.

UNIX time

Use instead of "epoch time".

unrecoverable

Use instead of "fatal".

upsert

Don't use. Instead, clarify the action by writing something such as, "Inserts rows if the rows don't exist, or updates rows if they do exist".

URI, URL

Use "URI" or "URL" when referring to the respective string type. Choose the most specific initialism for your scenario. See also URN.

URN

Don't use. Use "URI" instead.

use

Use instead of "leverage" or "utilize".

user base

Use as 2 words.

username

Use as 1 word in written text. If "user name" appears as 2 words in the UI, write "user name" as 2 words in the documentation to match.

utilize

Don't use. See use.

V

v

Spell out "version" instead of abbreviating with a "v".

Do this

Splunk platform versions 6.6.x and 7.0.x

verification

Use instead of "sanity check".

versus

Use instead of "vs.".

very

Don't use.

vetted

Don't use. See approved.

via

Don't use Latin abbreviations or terms. See by using or through.

vice versa, vice-versa

Don't use Latin abbreviations or terms. See and the reverse.

view

Use when describing the UI. Don't use "see".

Do this

Use this chart to view the percentage of crashes.

View app usage.

visit

Don't use in the context of internet sites. Use "go to", "navigate to", or another phrase.

vs.

Don't use Latin abbreviations or terms. See versus or use another phrase.

W

want

Use instead of "desire" or "wish" to show hope for or to express a need.

warning

Don't use as type of callout box. A warning indicates danger or bodily harm and appears in hardware documentation. See Best practices for using callout boxes.

web

Lowercase unless it is part of a proper name, like Splunk Web or World Wide Web.

when

Use to indicate an action, behavior, or event that is expected or certain to occur. This term implies a cause-and-effect relationship. See also after and if.

Do this

When a signal crosses the static threshold, an alert is triggered.

Don't do this

After a signal crosses the static threshold, an alert is triggered.

If a signal crosses the static threshold, an alert is triggered.

whether

Use instead of "whether or not".

whether or not

Don't use. See whether.

whitelist

Don't use. Use "allow list" as a noun and "allow" or "include" as a verb. For a single item, use "allow rule" or "allow entry". See allow, allow entry, allow list, allow rule. There are additional synonyms you can use in specific situations. "Allow" refers to access, "accept" refers to validity, and "include" refers to inclusion. For IP traffic, for example, "allow" is suitable. For files or rules, "include" might be more specific. See also blacklist.

Do this

Set up an allow list to include specific incoming data.

Don't do this

Whitelist the specific incoming data.

wildcarded

Don't use. Use "wildcard" with an asterisk in parentheses after the term to denote the search action of matching characters in string values. See also Show symbols in text.

Do this

You can use a wildcard ( * ) to match noninternal indexes in searches.

Don't do this

Indexes in searches can be wildcarded, although * matches only noninternal indexes.

wish

Don't use. See want.

wizard

Avoid using this term. Use only if you need to refer to the UI component and the label contains the word "wizard". If you must refer to the general component, use "guided setup" sparingly. Always aim to describe the user's actions and goals instead of the components and features of the product. See A word about Splunk docs for more information.

Do this

In Splunk Web, select Add Data to start getting data in.

Select App Wizard to design and develop an app framework.

Follow the step-by-step process provided in the Splunk Observability Cloud guided setup.

Don't do this

Use the Add Data wizard in Splunk Web.

Follow the step-by-step process provided in the Splunk Observability Cloud wizard.

would

Don't use. Avoid subjunctive mood. Write in the indicative or imperative mood instead. See Write in indicative or imperative mood.

X

x (HTTP status codes)

Use a lowercase "x" to represent a range of HTTP status codes.

Do this

4xx

The value of the span's status code tag is set to 5xx.

Don't do this

4XX

The value of the span's status code tag is set to 5XX.

x (version number in releases)

Use a lowercase "x" at the relevant place in the version number when referring to maintenance builds, minor versions, or releases for a product. Don't include a "v" before the number.

Do this

Splunk Enterprise 7.x

Splunk platform versions 6.6.x and 7.0.x

Don't do this

Splunk platform v5.0.x

Splunk platform version 7.1.X