SPL Syntax
Caio Lopes3 downloadsSyntax highlighting for Splunk SPL in fenced code blocks.
- Overview
- Scorecard
- Updates1
Splunk SPL syntax highlighting for Obsidian code blocks.
Document investigations, detections, dashboards, and hunting hypotheses with readable SPL. SPL Syntax plugs into Obsidian's native code-block pipeline, so spl blocks behave exactly like built-in languages in Reading View, Live Preview, and source mode on desktop and mobile.
Usage
index=main sourcetype=access_combined status>=400 earliest=-24h@h
| stats count AS errors BY status, host
| sort - errors
Use spl as the fenced-code language; ```splunk is an accepted alias. Blocks highlight through Obsidian's native code-block pipeline in both editing and reading modes: colorization stays active while you edit, the language flair copies the block ("Copied to your clipboard"), and colors come from your theme's code variables.
Highlighted syntax
| Token | Examples |
|---|---|
| Generating commands | search, tstats, from, inputlookup, makeresults |
| Processing commands | stats, eval, where, rex, timechart, lookup, streamstats |
| Keywords | AS, BY, OVER, WITH, OUTPUT, OUTPUTNEW |
| Functions | if, coalesce, strftime, cidrmatch, dc, perc95, bare count |
| Word operators | AND, OR, NOT, XOR, LIKE, IN |
| Macros | `security_indexes`, `drop_dm_object_name(Processes)` |
| Internal fields | _time, _raw, _indextime |
| Strings and field references | "GET /index.html", 'field with spaces' |
| Comments | ```only deltas``` |
| Literals | 404, -24h@h, @d, +7d@w1, now |
| Operators and brackets | ` |
Plain search terms and field names stay unstyled on purpose, so a query reads as text instead of noise.
Install
Community plugins
After acceptance into the Obsidian Community directory, search for SPL Syntax under Settings → Community plugins.
Manual installation
- Download
main.js,manifest.json, andstyles.cssfrom the latest matching GitHub release. - Create
<vault>/.obsidian/plugins/spl-syntax/. - Copy all three files into that directory.
- Enable SPL Syntax under Settings → Community plugins.
Query templates
| File | Purpose |
|---|---|
templates/getting-started.spl |
Index and sourcetype filtering, aggregation, sorting |
templates/reporting.spl |
Time series with timechart, derived fields, rename |
templates/threat-hunting.spl |
Accelerated tstats, subsearch, macro, rex, lookup |
The plugin only highlights templates; it never executes them.
Privacy and security
SPL Syntax runs locally. It makes no network requests, requires no account, reads no vault files, executes no queries, and includes no telemetry, analytics, advertisements, or payments. The plugin only registers language definitions with Obsidian's built-in highlighters; it never injects HTML or renders content itself.
Development
From a clean checkout, run the release checks in this order:
npm ci
npm run build
npm test
npm run verify:release
The production build creates the ignored main.js release asset.
Note on dependencies: use npm ci. A from-scratch npm install crashes on npm 10.x with Cannot read properties of null (reading 'edgesOut') — an npm bug in peer-graph resolution, not a project problem. If you need to refresh the lockfile, run it under npm 12 (npx --yes npm@12 install).
References
- Understanding SPL syntax
- Command quick reference
- Commands by category
- Command types
- SPL for SQL users
- Evaluation functions
- Statistical and charting functions
- Splunk cheat sheet: query, SPL, regex, commands
- StationX Splunk cheat sheet
- Obsidian plugin submission
- Obsidian plugin self-review checklist
License
MIT