如何在 LaTex 中编写 SPL？

Question

我到处搜索 Splunk 中使用的 SPl（搜索处理语言），并且我想像这样格式化我的代码：

我尝试使用 lstdefinelanguage 和 lstdefinestyle 基本功能（列表包），但效果远不及这个。以下是我的一段代码：

\lstdefinelanguage{SPL}
{
  keywords=[1]{},
  otherkeywords={% Operators
    case, match, strftime, num, count
  },
  keywords = [2]{AND, and, OR, or, AS, as},
  keywords =[3]{timeformat},
  keywordstyle=\color{pink},
  keywordstyle=[2]\color{orange},% for example
  keywordstyle=[3]\color{green}
}

\lstdefinestyle{mystyle}{
        language=SPL,
        backgroundcolor=\color{backcolour},
        commentstyle=\color{codegreen},
        morekeywords={spath, search, dedup, stats}
        keywordstyle=\color{blue},
        numberstyle=\footnotesize\color{codegray},
        xleftmargin=0.5cm,
        framexleftmargin=0.5cm,
        basicstyle=\footnotesize,
    }

以及我在 Latex main 中的一段代码：

\begin{lstlisting}[style=mystyle]
index="aaam_atr_tickets" $year$  | spath "coreData.type"
| search "coreData.type"=STANDALONE_INC_RD | dedup allFields.number 
| search allFields.state != "Resolved" AND allFields.state != "Closed" AND  allFields.state != "Resolution Confirmed" AND allFields.assignment_group != "Out of Scope" | convert timeformat="%Y-%m-%d %H:%M:%S" num(allFields.createdDate) As created
| eval year = strftime(created, "%Y") 
| where year= c_year
| eval squad=case(match('allFields.assignment_group',"EU-FR-RDBOPF-L2"),"PF", 
match('allFields.assignment_group',"EU-XX-RDQMP-L2") OR match('allFields.assignment_group',"EU-FR-RDBOMAT-L2"),"MAT", match('allFields.assignment_group',"EU-XX-RDCIM-L2"),"ENG",match('allFields.assignment_group',"EU-FR-RDBOPSR-L2") OR match('allFields.assignment_group',"EU-XX-RDPSR-L2") OR match('allFields.assignment_group',"EU-XX-RDPEE-L2"),"PSR Classic",match('allFields.assignment_group',"EU-XX-RDTTS-L2") OR match('allFields.assignment_group',"EU-XX-RDBRQ-L2"),"PSR 2")
| chart count by allFields.priority, squad
| rename allFields.priority as priority
\end{lstlisting}

Answer 1

在 MWE 的评论中指出了一些补充：

1. keywords而不是otherkeywords为了防止子字符串匹配（数字中的“num”）
2. 直立引号\usepackage[T1]{fontenc}（仅限 pdfLaTeX）
3. 无衬线字体，完全灵活的列（即不再等宽）
4. 打破长线
5. 将班级编号添加到morekeywords列表中

\documentclass{article}
\usepackage{listings}
\usepackage{xcolor}
\usepackage[T1]{fontenc} % 2
\lstdefinelanguage{SPL}
{
  keywords=[1]{% 1
    case, match, strftime, num, count
  },
  keywords = [2]{AND, and, OR, or, AS, As, as, by},
  keywords =[3]{timeformat},
  keywordstyle=\color{purple},
  keywordstyle=[2]\color{orange},
  keywordstyle=[3]\color{green!75!black}
}

\lstdefinestyle{mystyle}{
        basicstyle=\footnotesize\sffamily, % 3
        columns=fullflexible, % 3 alternative columns=flexible for a bit more space
        breaklines=true, % 4
        language=SPL,
        backgroundcolor=\color{white},
        commentstyle=\color{green},
        morekeywords=[4]{spath, search, dedup, stats, eval, convert, chart, rename}, % 5
        keywordstyle=[4]\color{blue}, % 5
        numberstyle=\footnotesize\color{gray},
        xleftmargin=0.5cm,
        framexleftmargin=0.5cm,
    }
    
\begin{document}
\begin{lstlisting}[style=mystyle]
index="aaam_atr_tickets" $year$  | spath "coreData.type"
| search "coreData.type"=STANDALONE_INC_RD | dedup allFields.number 
| search allFields.state != "Resolved" AND allFields.state != "Closed" AND  allFields.state != "Resolution Confirmed" AND allFields.assignment_group != "Out of Scope" | convert timeformat="%Y-%m-%d %H:%M:%S" num(allFields.createdDate) As created
| eval year = strftime(created, "%Y") 
| where year= c_year
| eval squad=case(match('allFields.assignment_group',"EU-FR-RDBOPF-L2"),"PF", match('allFields.assignment_group',"EU-XX-RDQMP-L2") OR match('allFields.assignment_group',"EU-FR-RDBOMAT-L2"),"MAT", match('allFields.assignment_group',"EU-XX-RDCIM-L2"),"ENG",match('allFields.assignment_group',"EU-FR-RDBOPSR-L2") OR match('allFields.assignment_group',"EU-XX-RDPSR-L2") OR match('allFields.assignment_group',"EU-XX-RDPEE-L2"),"PSR Classic",match('allFields.assignment_group',"EU-XX-RDTTS-L2") OR match('allFields.assignment_group',"EU-XX-RDBRQ-L2"),"PSR 2")
| chart count by allFields.priority, squad
| rename allFields.priority as priority
\end{lstlisting}
\end{document}

结果：