Added support for Splunk SPL (#1962)

This adds support for Splunk SPL and corrects the position of the SQL in `components.json`.

components.json

@@ -832,15 +832,19 @@
 			"require": "markup-templating",
 			"owner": "Golmote"
 		},
-		"sql": {
-			"title": "SQL",
-			"owner": "multipetros"
-		},
 		"soy": {
 			"title": "Soy (Closure Template)",
 			"require": "markup-templating",
 			"owner": "Golmote"
 		},
+		"splunk-spl": {
+			"title": "Splunk SPL",
+			"owner": "RunDevelopment"
+		},
+		"sql": {
+			"title": "SQL",
+			"owner": "multipetros"
+		},
 		"stylus": {
 			"title": "Stylus",
 			"owner": "vkbansal"

components/prism-splunk-spl.js

@@ -0,0 +1,24 @@
+Prism.languages['splunk-spl'] = {
+	'comment': /`comment\("(?:\\.|[^\\"])*"\)`/,
+	'string': {
+		pattern: /"(?:\\.|[^\\"])*"/,
+		greedy: true
+	},
+	// https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/ListOfSearchCommands
+	'keyword': /\b(?:abstract|accum|addcoltotals|addinfo|addtotals|analyzefields|anomalies|anomalousvalue|anomalydetection|append|appendcols|appendcsv|appendlookup|appendpipe|arules|associate|audit|autoregress|bin|bucket|bucketdir|chart|cluster|cofilter|collect|concurrency|contingency|convert|correlate|datamodel|dbinspect|dedup|delete|delta|diff|erex|eval|eventcount|eventstats|extract|fieldformat|fields|fieldsummary|filldown|fillnull|findtypes|folderize|foreach|format|from|gauge|gentimes|geom|geomfilter|geostats|head|highlight|history|iconify|input|inputcsv|inputlookup|iplocation|join|kmeans|kv|kvform|loadjob|localize|localop|lookup|makecontinuous|makemv|makeresults|map|mcollect|metadata|metasearch|meventcollect|mstats|multikv|multisearch|mvcombine|mvexpand|nomv|outlier|outputcsv|outputlookup|outputtext|overlap|pivot|predict|rangemap|rare|regex|relevancy|reltime|rename|replace|rest|return|reverse|rex|rtorder|run|savedsearch|script|scrub|search|searchtxn|selfjoin|sendemail|set|setfields|sichart|sirare|sistats|sitimechart|sitop|sort|spath|stats|strcat|streamstats|table|tags|tail|timechart|timewrap|top|transaction|transpose|trendline|tscollect|tstats|typeahead|typelearner|typer|union|uniq|untable|where|x11|xmlkv|xmlunescape|xpath|xyseries)\b/i,
+	'operator-word': {
+		pattern: /\b(?:and|as|by|not|or|xor)\b/i,
+		alias: 'operator'
+	},
+	'function': /\w+(?=\s*\()/,
+	'property': /\w+(?=\s*=(?!=))/,
+	'date': {
+		// MM/DD/YYYY(:HH:MM:SS)?
+		pattern: /\b\d{1,2}\/\d{1,2}\/\d{1,4}(?:(?::\d{1,2}){3})?\b/,
+		alias: 'number'
+	},
+	'number': /\b\d+(?:\.\d+)?\b/,
+	'boolean': /\b(?:f|false|t|true)\b/i,
+	'operator': /[<>=]=?|[-+*/%|]/,
+	'punctuation': /[()[\],]/
+}

examples/prism-splunk-spl.html

@@ -0,0 +1,7 @@
+<h2>Full example</h2>
+<pre><code>source=monthly_data.csv
+| rename remote_ip AS ip
+| eval isLocal=if(cidrmatch("123.132.32.0/25",ip), "local", "not local")
+| eval error=case(status == 200, "OK", status == 404, "Not found", true(), "Other")
+  `comment("TODO: Add support for more status codes")`
+| sort amount</code></pre>

plugins/show-language/prism-show-language.js

@@ -117,8 +117,9 @@
 		"sass": "Sass (Sass)",
 		"scss": "Sass (Scss)",
 		"shell-session": "Shell session",
-		"sql": "SQL",
 		"soy": "Soy (Closure Template)",
+		"splunk-spl": "Splunk SPL",
+		"sql": "SQL",
 		"tap": "TAP",
 		"toml": "TOML",
 		"tt2": "Template Toolkit 2",

tests/languages/splunk-spl/comment_feature.test

@@ -0,0 +1,16 @@
+`comment("This is a comment")`
+`comment("This is too
+but on more than one line")`
+`comment("| stats sum(b) BY index")`
+
+----------------------------------------------------
+
+[
+	["comment", "`comment(\"This is a comment\")`"],
+	["comment", "`comment(\"This is too\r\nbut on more than one line\")`"],
+	["comment", "`comment(\"| stats sum(b) BY index\")`"]
+]
+
+----------------------------------------------------
+
+Checks for comments.

tests/languages/splunk-spl/date_feature.test

@@ -0,0 +1,13 @@
+1/1/1970
+12/31/1999:23:59:59
+
+----------------------------------------------------
+
+[
+	["date", "1/1/1970"],
+	["date", "12/31/1999:23:59:59"]
+]
+
+----------------------------------------------------
+
+Checks for dates.