splunk.JSON-tmLanguage

// [PackageDev] target_format: plist, ext: tmLanguage
{
    "name": "Splunk Query Language",
    "scopeName": "source.splunk",
    "fileTypes": ["splunk", "spl"],
    "uuid": "8fbbb1e7-8311-4bdc-aaef-a1639ca8d0ad",

    "patterns": [
        {
            "match": "\\b(abstract|accum|addcoltotals|addinfo|addtotals|analyzefields|anomalies|anomalousvalue|append|appendcols|appendpipe|arules|associate|audit|autoregress|bucket|bucketdir|chart|cluster|collect|concurrency|contingency|convert|correlate|crawl|datamodel|dbinspect|dedup|delete|delta|diff|dispatch|erex|eval|eventcount|eventstats|extract|fieldformat|fields|fieldsummary|file|filldown|fillnull|findtypes|folderize|foreach|format|gauge|gentimes|geostats|head|highlight|history|input|inputcsv|inputlookup|iplocation|join|kmeans|kvform|loadjob|localize|localop|lookup|makecontinuous|makemv|map|metadata|metasearch|multikv|multisearch|mvcombine|mvexpand|nomv|outlier|outputcsv|outputlookup|outputtext|overlap|pivot|predict|rangemap|rare|regex|relevancy|reltime|rename|replace|rest|return|reverse|rex|rtorder|run|savedsearch|script|scrub|search|searchtxn|selfjoin|sendemail|set|setfields|sichart|sirare|sistats|sitimechart|sitop|sort|spath|stats|strcat|streamstats|table|tags|tail|timechart|top|transaction|transpose|trendline|tscollect|tstats|typeahead|typelearner|typer|uniq|untable|where|x11|xmlkv|xmlunescape|xpath|xyseries)\\b",
            "name": "support.class.splunk",
            "comment": "Splunk Built-in function"
        },

        {
            "match": "([A-Za-z0-9]+) *\\(",
            "comment": "Function calls",
            "captures": {
                "1": { "name": "support.class.splunk" }
            }
        },

        {
            "match": "\\b(\\d+)\\b",
            "comment": "Digits",
            "name": "constant.numeric.splunk"
        },

        {
            "match": "\\|",
            "comment": "Splunk Pipe",
            "name": "constant.language.splunk"
        },

        {
            "match": "\\b(AND|OR|as|AS|by|BY)\\b",
            "comment": "Splunk Operators",
            "name": "keyword.operator.splunk"
        },

        {
            "match": "=",
            "comment": "Comparison or assignment",
            "name": "keyword.operator.splunk"
        },

        {
            "name": "string.quoted.double.splunk",
            "begin": "(?<!\\\\)\"",
            "end": "(?<!\\\\)\""
        },

        {
            "name": "string.quoted.single.splunk",
            "begin": "(?<!\\\\)'",
            "end": "(?<!\\\\)'"
        }
    ]
}