Splunk® Style Guide

Splunk Style Guide

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Line breaks

Split up long lines of code with line breaks so that the lines of code fit within the page width and don't extend off the screen.

When deciding where to break a search string, prioritize the break based on the following list:

  1. Before a pipe
  2. At a space
  3. Before an open parenthesis or bracket
  4. After a close parenthesis or bracket
  5. Before or after an equal sign
  6. Before or after any equation symbol, such as *, /, +, >, <, or -
  7. After a dot, such as in a URL

Line break example

Consider the following search:

sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, distinct_count(productId), values(productId) by clientip

Because this search is longer than one line, a logical place to break this line is between clientip=87.194.216.51 and | stats, rather than between count, and distinct_count(productId).

The break appears as follows:

sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, distinct_count(productId), values(productId) by clientip

Last modified on 25 May, 2022
PREVIOUS
Formatting reference
  NEXT
Abbreviations

This documentation applies to the following versions of Splunk® Style Guide: current


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters