github.com/siglens/siglens@v0.0.0-20240328180423-f7ce9ae441ed/pkg/ast/spl/spl.peg

{
package spl

import (
    "regexp"
    "time"

    "github.com/siglens/siglens/pkg/ast"
    "github.com/siglens/siglens/pkg/segment/aggregations"
    "github.com/siglens/siglens/pkg/segment/query"
    "github.com/siglens/siglens/pkg/segment/structs"
    "github.com/siglens/siglens/pkg/segment/utils"
    log "github.com/sirupsen/logrus"
)

func getParseError(err error) error {
    switch ev := err.(type) {
    case errList:
        if pe, ok := ev[0].(*parserError); ok {
            return &ast.ParseError{
                Inner:    pe.Inner,
                Line:     pe.pos.line,
                Column:   pe.pos.col,
                Offset:   pe.pos.offset,
                Prefix:   pe.prefix,
                Expected: pe.expected,
            }
        }
    }
    return err
}

// Remove the first and last character of the string
func removeQuotes(s any) string {
    str := s.(string)
    if len(str) < 3 {
        return ""
    }

    return str[1:len(str)-1]
}

// Check if it rename fields with similar names using a wildcard
func isRegexRename(originalPattern, newPattern string) (bool, error) {
    oldWildcards := strings.Count(originalPattern, "*")
    newWildcards := strings.Count(newPattern, "*")

    if oldWildcards == 0 && newWildcards == 0 {
        return false, nil
    } else if oldWildcards > 0 && oldWildcards == newWildcards {
        return true, nil
    } else {
        return false, errors.New("Patterns do not match")
    }
}

func deMorgansLaw(node *ast.Node) {
    switch node.NodeType {
    case ast.NodeTerminal:
        switch node.Comparison.Op {
        case "=":
            node.Comparison.Op = "!="
        case "!=":
            node.Comparison.Op = "="
        case ">":
            node.Comparison.Op = "<="
        case "<":
            node.Comparison.Op = ">="
        case ">=":
            node.Comparison.Op = "<"
        case "<=":
            node.Comparison.Op = ">"
        default:
            log.Errorf("deMorgansLaw: unexpected node comparison op: %v", node.Comparison.Op)
        }
    case ast.NodeAnd:
        node.NodeType = ast.NodeOr
        deMorgansLaw(node.Left)
        deMorgansLaw(node.Right)
    case ast.NodeOr:
        node.NodeType = ast.NodeAnd
        deMorgansLaw(node.Left)
        deMorgansLaw(node.Right)
    default:
        log.Errorf("deMorgansLaw: unexpected NodeType: %v", node.NodeType)
    }
}

//Generate NumericExpr struct for eval functions
func createNumericExpr(op string, leftNumericExpr *structs.NumericExpr, rightNumericExpr *structs.NumericExpr, numericExprMode structs.NumericExprMode) (*structs.NumericExpr, error) {
    if leftNumericExpr == nil {
        return nil, fmt.Errorf("expr cannot be nil")
    }

    return &structs.NumericExpr{
        IsTerminal: false,
        Op: op,
        Left: leftNumericExpr,
        Right: rightNumericExpr,
        NumericExprMode: numericExprMode,
    }, nil
}

func transferUint8ToString(opName interface{}) (string, error){
    strData, ok := opName.([]byte)
    if !ok {
        return "", fmt.Errorf("opName is not a []byte")
    }

    opNameStr := string(strData)
    return opNameStr, nil
}

func transferPCREToRE2(pattern string) string {
    pattern = strings.Replace(pattern, "(?<", "(?P<", -1)
    return pattern
}

func getRexColNames(pattern string) ([]string, error) {
    re, err := regexp.Compile(`\?<(?P<GroupName>[a-zA-Z0-9_]+)>`)
    if err != nil {
        return nil, fmt.Errorf("getRexColNames: There are some errors in the pattern: %v", err)
    }
    matches := re.FindAllStringSubmatch(pattern, -1)

    var rexColNames []string
    for _, match := range matches {
        rexColNames = append(rexColNames, match[1])
    }

    return rexColNames, nil
}

type aggregator struct {
    measureAgg          *structs.MeasureAggregator
    renameOutputField   bool
    outputFieldNewName  string
}

type singleAggTemp struct {
    aggregators []*aggregator
    SplitByClause *structs.SplitByClause
}

type TxnArgs struct {
    argOption string
    arguments *structs.TransactionArguments
}

type TimechartArgs struct {
    singleAggExpr *singleAggTemp
    // Todo: Add eval clause expr.
    tcOptions     *structs.TcOptions
}
}

Start <- SPACE? initialSearch:(InitialSearchBlock) filterBlocks:(FilterBlock)* queryAggBlocks:(QueryAggergatorBlock)* SPACE? EOF {
    var q ast.QueryStruct
    q.SearchFilter = initialSearch.(*ast.Node)

    // Join the InitialSearchBlock with the FilterBlocks with AND nodes. For a
    // search like "A | B | C | D" we should generate the node structure below
    // so that when we run the search it evaluates A first.
    //
    //      AND
    //     /   \
    //    A     AND
    //         /   \
    //        B     AND
    //             /   \
    //            C     D

    filterBlocksSlice := filterBlocks.([]any)
    switch len(filterBlocksSlice) {
    case 0:
        q.SearchFilter = initialSearch.(*ast.Node)
    case 1:
        q.SearchFilter = &ast.Node {
            NodeType: ast.NodeAnd,
            Left: initialSearch.(*ast.Node),
            Right: filterBlocksSlice[0].(*ast.Node),
        }
    default: // len > 1
        // Iterate backwards so we build the node structure mentioned above.
        root := filterBlocksSlice[len(filterBlocksSlice) - 1].(*ast.Node)
        for i := len(filterBlocksSlice) - 2; i > -1; i-- {
            newRoot := &ast.Node {
                NodeType: ast.NodeAnd,
                Left: filterBlocksSlice[i].(*ast.Node),
                Right: root,
            }

            root = newRoot
        }

        q.SearchFilter = &ast.Node {
            NodeType: ast.NodeAnd,
            Left: initialSearch.(*ast.Node),
            Right: root,
        }
    }

    if queryAggBlocks != nil {
        queryAggSlice := queryAggBlocks.([]any)

        if len(queryAggSlice) > 0 {
            // Chain together all QueryAggergators.
            q.PipeCommands = queryAggSlice[0].(*structs.QueryAggregators)

            // Go to the end of the first chain.
            curQueryAgg := q.PipeCommands
            for ; curQueryAgg.Next != nil; curQueryAgg = curQueryAgg.Next {}

            // Link the remaining chains.
            for i := range queryAggSlice[1:] {
                queryAgg := queryAggSlice[i + 1].(*structs.QueryAggregators)
                curQueryAgg.Next = queryAgg

                // Go to the end of this chain.
                for ; curQueryAgg.Next != nil; curQueryAgg = curQueryAgg.Next {}
            }
        }
    }

    return q, nil
}

InitialSearchBlock <- CMD_SEARCH? clause:ClauseLevel4 {
    return clause, nil
}

SearchBlock <- !(ALLCMD) CMD_SEARCH? clause:ClauseLevel4 {
    return clause, nil
}

FilterBlock <- PIPE block:(SearchBlock / RegexBlock) {
    return block, nil
}

// Returns *structs.QueryAggregators
QueryAggergatorBlock <- block:(FieldSelectBlock / AggregatorBlock / EvalBlock / WhereBlock / HeadBlock / RexBlock / StatisticBlock / RenameBlock / TimechartBlock / TransactionBlock / DedupBlock / SortBlock) {
    queryAgg := block.(*structs.QueryAggregators)
    return queryAgg, nil
}

FieldSelectBlock <- PIPE CMD_FIELDS op:("-" / "+")? EMPTY_OR_SPACE fields:FieldNameList {
    columnsRequest := &structs.ColumnsRequest{}
    if op == nil || string(op.([]byte)) == "+" {
        columnsRequest.IncludeColumns = fields.([]string)
    } else {
        columnsRequest.ExcludeColumns = fields.([]string)
    }

    queryAggregator := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            OutputColumns: columnsRequest,
        },
    }

    return queryAggregator, nil
}

AggregatorBlock <- PIPE CMD_STATS aggs:AggregationList byFields:(GroupbyBlock)? {
    aggNode := &structs.QueryAggregators{}

    // Extract the MeasureAggregators and check if any of the aggregation fields
    // need to be renamed.
    aggsSlice := aggs.([]*aggregator)
    measureAggs := make([]*structs.MeasureAggregator, len(aggsSlice))
    columnsRequest := &structs.ColumnsRequest{}
    columnsRequest.RenameAggregationColumns = make(map[string]string, 0)

    for i, agg := range aggsSlice {
        measureAggs[i] = agg.measureAgg

        if agg.renameOutputField {
            columnsRequest.RenameAggregationColumns[measureAggs[i].String()] = agg.outputFieldNewName
        }
    }

    // If any agg field was renamed, make a QueryAggregators for all the renames.
    if len(columnsRequest.RenameAggregationColumns) > 0 {
        renameNode := &structs.QueryAggregators {
            PipeCommandType: structs.OutputTransformType,
            OutputTransforms: &structs.OutputTransforms {
                OutputColumns: columnsRequest,
            },
        }

        aggNode.Next = renameNode
    }

    if byFields == nil {
        aggNode.PipeCommandType = structs.MeasureAggsType
        aggNode.MeasureOperations = measureAggs
    } else {
        aggNode.PipeCommandType = structs.GroupByType
        aggNode.GroupByRequest = &structs.GroupByRequest {
            MeasureOperations: measureAggs,
            GroupByColumns: byFields.([]string),
        }
        aggNode.BucketLimit = query.MAX_GRP_BUCKS
    }

    return aggNode, nil
}

GroupbyBlock <- BY fields:FieldNameList {
    // Wildcard fields are not allowed. See https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Stats
    for _, field := range fields.([]string) {
        if strings.Contains(field, "*") {
            return nil, errors.New("BY clause cannot contain fields with wildcards")
        }
    }

    return fields, nil
}

RegexBlock <- CMD_REGEX keyAndOp:(FieldName EqualityOperator)? str:QuotedString {
    var key, op string
    if keyAndOp == nil {
        key = "*"
        op = "="
    } else {
        keyAndOpSlice := keyAndOp.([]any)
        key = keyAndOpSlice[0].(string)
        op = keyAndOpSlice[1].(string)
    }

    // Remove the quotation marks.
    regex := str.(string)
    regex = regex[1:len(regex) - 1]

    node := &ast.Node {
        NodeType: ast.NodeTerminal,
        Comparison: ast.Comparison {
            Op: op,
            Field: key,
            Values: regex,
            ValueIsRegex: true,
        },
    }

    return node, nil
}

ClauseLevel4 <- first:ClauseLevel3 rest:((AND / SPACE) ClauseLevel3)* {
    if rest == nil {
        return first, nil
    }

    cur := first.(*ast.Node)
    for _, v := range rest.([]any) {
        parts := v.([]any)  // This will be [(AND / SPACE), ClauseLevel3].
        cur = &ast.Node {
            NodeType: ast.NodeAnd,
            Left: cur,
            Right: parts[1].(*ast.Node),
        }
    }

    return cur, nil
}

ClauseLevel3 <- first:ClauseLevel2 rest:(OR ClauseLevel2)* {
    if rest == nil {
        return first, nil
    }

    cur := first.(*ast.Node)
    for _, v := range rest.([]any) {
        parts := v.([]any)  // This will be [OR, ClauseLevel2].
        cur = &ast.Node {
            NodeType: ast.NodeOr,
            Left: cur,
            Right: parts[1].(*ast.Node),
        }
    }

    return cur, nil
}

ClauseLevel2 <- notList:NOT+ first:ClauseLevel1 {
    // There's an issue with how queries with AST Not nodes are run, so use
    // De Morgan's law to manipulate the expression.
    node := first.(*ast.Node)
    numNots := len(notList.([]any))

    if numNots % 2 == 1 {
        deMorgansLaw(node)
    }

    return node, nil
} / clause:ClauseLevel1 {
    return clause, nil
}

ClauseLevel1 <- L_PAREN clause:ClauseLevel4 R_PAREN {
    return clause, nil
} / term:SearchTerm {
    return term, nil
}

// Parsing the text of a Number as a String would succeed, so we need to try
// parsing as a FieldWithNumberValue first.
SearchTerm <- term:(FieldWithNumberValue / FieldWithBooleanValue / FieldWithStringValue) {
    return term, nil
}

// To be finished: add (<eval-expression>) BY <split-by-clause> ) for expr; Limit option ...
TimechartBlock <- PIPE CMD_TIMECHART tcArgs:TimechartArgumentsList limitExpr:(LimitExpr)? {
    aggNode := &structs.QueryAggregators{}

    columnsRequest := &structs.ColumnsRequest{}
    columnsRequest.RenameAggregationColumns = make(map[string]string, 0)
    measureAggs := make([]*structs.MeasureAggregator, 0)

    timechartExpr := &structs.TimechartExpr{}
    byField := ""

    if tcArgs == nil {
        return nil, fmt.Errorf("spl peg: timechart: either single-agg or eval-expression by split-by-clause is required")
    }
    
    timechartArgs := tcArgs.(*TimechartArgs)
    
    // Todo: Should add || timechartArgs.evalExpr == nil
    if timechartArgs.singleAggExpr == nil {
        return nil, fmt.Errorf("spl peg: timechart: either single-agg or eval-expression by split-by-clause is required")
    }

    var bOptions *structs.BinOptions
    
    if timechartArgs.tcOptions != nil {
        if timechartArgs.tcOptions.BinOptions != nil {
            bOptions = timechartArgs.tcOptions.BinOptions
        }
    }

    if timechartArgs.singleAggExpr != nil {
        singleAgg := &structs.SingleAgg{}
        aggTemp := timechartArgs.singleAggExpr

        for i, agg := range aggTemp.aggregators {
            measureAggs = append(measureAggs, agg.measureAgg)

            if agg.renameOutputField {
                measureAggs[i].StrEnc = agg.outputFieldNewName
            }
        }

        singleAgg.MeasureOperations = measureAggs
        timechartExpr.SingleAgg = singleAgg

        if aggTemp.SplitByClause != nil {
            byField = aggTemp.SplitByClause.Field
        }
    }

    // TODO: if timechartArgs.evalExpr != nil {}

    aggNode.PipeCommandType = structs.GroupByType
    aggNode.GroupByRequest = &structs.GroupByRequest{
        MeasureOperations: measureAggs,
        GroupByColumns:    []string{"timestamp"},
    }
    aggNode.BucketLimit = query.MAX_GRP_BUCKS

    if bOptions == nil {
        bOptions = &structs.BinOptions{
            SpanOptions: &structs.SpanOptions{
                DefaultSettings: true,
                SpanLength: &structs.SpanLength{
                    Num: 1,
                    TimeScalr: utils.TMMinute,
                },
            },
        }
    }

    var limitExprTmp *structs.LimitExpr
    if limitExpr != nil {
        limitExprTmp = limitExpr.(*structs.LimitExpr)
        if len(measureAggs) > 1 {
            limitExprTmp.LimitScoreMode = structs.LSMByFreq
        }
    }

    timeBucket := aggregations.InitTimeBucket(bOptions.SpanOptions.SpanLength.Num, bOptions.SpanOptions.SpanLength.TimeScalr, byField, limitExprTmp, len(measureAggs))
    aggNode.TimeHistogram = timeBucket

    return aggNode, nil
}

// To be finished: <eval-expression> BY <split-by-clause>
// TimechartEvalExpr <- ... BY splitByClause:(SplitByClause) {
// }

TimechartArgumentsList <- first:TimechartArgument rest:(SPACE TimechartArgument)* {
    restSlice := rest.([]any)
    timechartArgs := &TimechartArgs{}

    numArgs := 1 + len(restSlice)

    for i :=0; i < numArgs; i++ {

        var numArg interface{}

        if i == 0 {
            numArg = first
        } else {
            numArg = restSlice[i - 1].([]any)[1]
        }

        switch numArg.(type) {
            case *singleAggTemp:
                timechartArgs.singleAggExpr = numArg.(*singleAggTemp)
            case *structs.TcOptions:
                timechartArgs.tcOptions = numArg.(*structs.TcOptions)
            default:
                return nil, fmt.Errorf("Spl peg: Timechart: invalid timechart argument: %v", numArg)
        }
    }
    
    return timechartArgs, nil
}

TimechartArgument <- tcArg:(SingleAggExpr / TcOptions) {
    return tcArg, nil
}

SingleAggExpr <- aggs:AggregationList splitByClause:SplitByClause? {
    singleAggExpr := &singleAggTemp {
        aggregators: aggs.([]*aggregator),
    }

    if splitByClause != nil {
        singleAggExpr.SplitByClause = splitByClause.(*structs.SplitByClause)
    }

    return singleAggExpr, nil
}

// Syntax: <field> (<tc-options>)... [<where-clause>]
// <where-clause> to be finished
SplitByClause <- BY field:FieldName {
    splitByClause := &structs.SplitByClause {
        Field: field.(string),
    }

    return splitByClause, nil
}

TcOptions <- option:(BinOptions / (TcOption)+) {
    //Default value
    tcOptions := &structs.TcOptions{
        UseNull: true,
        UseOther: true,
        NullStr: "null",
        OtherStr: "other",
    }
    switch option.(type) {
    case *structs.BinOptions:
        tcOptions.BinOptions = option.(*structs.BinOptions)
    case [][]string:
        optionSlice := option.([]any)
        for _, opt := range optionSlice {
            optArr := opt.([]string)
            switch optArr[0] {
                case "usenull":
                    useNullBool, err := strconv.ParseBool(optArr[1])
                    if err != nil {
                        return nil, fmt.Errorf("Spl peg: Timechart: TcOptions: %v", err)
                    }
                    tcOptions.UseNull = useNullBool
                case "useother":
                    useOtherBool, err := strconv.ParseBool(optArr[1])
                    if err != nil {
                        return nil, fmt.Errorf("Spl peg: Timechart: TcOptions: %v", err)
                    }
                    tcOptions.UseOther = useOtherBool
                case "nullstr":
                    tcOptions.OtherStr = optArr[1]
                case "otherstr":
                    tcOptions.OtherStr = optArr[1]
                default:
                    return nil, fmt.Errorf("Spl peg: Timechart: TcOptions: invalid option: %v", optArr[0])
            }
        }
    default:
        return nil, fmt.Errorf("Spl peg: Timechart: Invalid tcOptions %v", option)
    }
    return tcOptions, nil
}

TcOption <- SPACE tcOptionCMD:TcOptionCMD EQUAL val:EvalFieldToRead {
    tcOptionArr := []string{tcOptionCMD.(string), val.(string)}
    return tcOptionArr, nil
}

TcOptionCMD <- option:("usenull" / "useother" / "nullstr" / "otherstr") {
    optionStr, err := transferUint8ToString(option)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: Timechart: TcOptionCMD: %v", err)
    }
    return optionStr, nil
}

// To be finished: bins=<int> | minspan=<span-length> | span | <start-end>: (end=<num> | start=<num>) | aligntime=(earliest | latest | <time-specifier>)
BinOptions <- spanOptions:SpanOptions {
    binOptions := &structs.BinOptions {
        SpanOptions: spanOptions.(*structs.SpanOptions),
    }
    return binOptions, nil
}

// To be finished: span=<log-span> | span=<span-length> | span=<snap-to-time>
SpanOptions <- CMD_SPAN EQUAL spanLength:SpanLength {
    spanOptions := &structs.SpanOptions {
        SpanLength: spanLength.(*structs.SpanLength),
    }
    return spanOptions, nil
}

SpanLength <- intAsStr:IntegerAsString timeScale:TimeScale{
    num, err := strconv.Atoi(intAsStr.(string))
    if err != nil {
        return nil, fmt.Errorf("SpanLength: Invalid num (%v): %v", intAsStr.(string), err)
    }

    spanLength := &structs.SpanLength {
        Num: num,
        TimeScalr: timeScale.(utils.TimeUnit),
    }
    return spanLength, nil
}

TimeScale <- timeUnit:(Second / Minute / Hour / Day/ Week / Month / Quarter/ Subseconds) {
    return timeUnit, nil
}

// limit=topN keeps the N highest scoring distinct values of the split-by field
LimitExpr <- SPACE "limit" EQUAL sortBy:("top" / "bottom")? EMPTY_OR_SPACE intAsStr:(IntegerAsString){
    num, err := strconv.Atoi(intAsStr.(string))
    if err != nil {
        return nil, fmt.Errorf("SpanLength: Invalid num (%v): %v", intAsStr.(string), err)
    }

    limitExpr := &structs.LimitExpr {
        IsTop: true, // Default Value
        Num: num,
    }

    if sortBy != nil {
        sortByStr, err := transferUint8ToString(sortBy)
        if err != nil {
            return nil, fmt.Errorf("Spl peg: Timechart: %v", err)
        }
        if sortByStr == "bottom" {
            limitExpr.IsTop = false
        }
    }

    return limitExpr, nil
}

StatisticBlock <- PIPE statisticExpr:StatisticExpr {
    letColReq := &structs.LetColumnsRequest {
        StatisticColRequest: statisticExpr.(*structs.StatisticExpr),
    }

    root := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            LetColumns: letColReq,
        },
    }

    measureAgg := &structs.MeasureAggregator {
        MeasureCol: "*",
        MeasureFunc: utils.Count,
    }

    measureOperations := make([]*structs.MeasureAggregator, 1)
    measureOperations[0] = measureAgg

    groupByColumns := append(statisticExpr.(*structs.StatisticExpr).FieldList, statisticExpr.(*structs.StatisticExpr).ByClause...)

    aggNode := &structs.QueryAggregators{}
    aggNode.Next = root
    aggNode.PipeCommandType = structs.GroupByType
    aggNode.GroupByRequest = &structs.GroupByRequest {
        MeasureOperations: measureOperations,
        GroupByColumns: groupByColumns,
    }

    return aggNode, nil
}

StatisticExpr <- cmd:(CMD_TOP / CMD_RARE) limit:(StatisticLimit)? fieldList:(SPACE FieldNameList) byClause:(ByClause)? options:(StatisticOptions)? {

    statisticExpr := &structs.StatisticExpr {
        FieldList: fieldList.([]interface{})[1].([]string),
    }

    statisticCmd, err := transferUint8ToString(cmd)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: StatisticExpr: %v", err)
    }

    if(statisticCmd == "top"){
        statisticExpr.StatisticFunctionMode = structs.SFMTop
    } else {
        statisticExpr.StatisticFunctionMode = structs.SFMRare
    }

    if limit != nil {
        statisticExpr.Limit = limit.(string)
    }

    if options != nil {
        statisticExpr.StatisticOptions = options.(*structs.StatisticOptions)
    } else {
        statisticExpr.StatisticOptions = &structs.StatisticOptions {
            ShowCount: true,
            CountField: "count",
            ShowPerc: true,
            PercentField: "percent",
            UseOther: false,
            OtherStr: "Other",
        }
    }

    if byClause != nil {
        statisticExpr.ByClause = byClause.([]string)
    }

    return statisticExpr, nil
}

// Top limit=<int> is the same as specifying top N.
StatisticLimit <- SPACE number:IntegerAsString {
    return number.(string), nil
}
/ SPACE "limit" EQUAL limit:(IntegerAsString) {
    return limit.(string), nil
}

// Optional arguments for top/rare functions
StatisticOptions <- option:(StatisticOption)*
{
    //Default value
    options := &structs.StatisticOptions {
        ShowCount: true,
        CountField: "count",
        ShowPerc: true,
        PercentField: "percent",
        UseOther: false,
        OtherStr: "other",
    }

    optionSlice := option.([]any)
    for _, opt := range optionSlice {
        optArr :=  opt.([]string)
        // Check for matching option types
        switch optArr[0] {
        case "showcount":
            showCountBool, err := strconv.ParseBool(optArr[1])
            if err != nil {
                return nil, fmt.Errorf("Spl peg: StatisticBlock: Options: %v", err)
            }
            options.ShowCount = showCountBool
        case "countfield":
            options.CountField = optArr[1]
        case "showperc":
            showPercBool, err := strconv.ParseBool(optArr[1])
            if err != nil {
                return nil, fmt.Errorf("Spl peg: StatisticBlock: Options: %v", err)
            }
            options.ShowPerc = showPercBool
        case "percentfield":
            options.PercentField = optArr[1]
        case "useother":
            useOtherBool, err := strconv.ParseBool(optArr[1])
            if err != nil {
                return nil, fmt.Errorf("Spl peg: StatisticBlock: Options: %v", err)
            }
            options.UseOther = useOtherBool
        case "otherstr":
            options.OtherStr = optArr[1]
        default:
            return nil, fmt.Errorf("Spl peg: StatisticBlock: Options: invalid option")
        }
    }

    return options, nil
}

StatisticOption <- SPACE optionCMD:StatisticOptionCMD EQUAL field:EvalFieldToRead {
    optionArr := []string{optionCMD.(string), field.(string)}
    return optionArr, nil
}

StatisticOptionCMD <- option:("countfield" / "showcount" / "otherstr" / "useother"/ "percentfield" / "showperc") {
    optionStr, err := transferUint8ToString(option)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: StatisticExpr: %v", err)
    }
    return optionStr, nil
}

ByClause <- BY fieldList:FieldNameList {
    return fieldList.([]string), nil
}
/ groupByBlock:GroupbyBlock {
    return groupByBlock.([]string), nil
}

DedupBlock <- PIPE CMD_DEDUP dedupExpr:DedupExpr {

    letColReq := &structs.LetColumnsRequest {
        DedupColRequest: dedupExpr.(*structs.DedupExpr),
    }

    root := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            LetColumns: letColReq,
        },
    }

    return root, nil
}

// Returns *structs.DedupExpr
// It's not clear in the Splunk documentation whether the DedupOptions should
// be before or after the field list. However, the field list probably
// shouldn't be after the sortby clause.
DedupExpr <- limitArr:(SPACE IntegerAsString)? options1:(DedupOptions)? fieldList:(DedupFieldList)? options2:(DedupOptions)? sortByClause:(DedupSortByClause)? {
    dedupExpr := &structs.DedupExpr {
        FieldList: fieldList.([]string),
        Limit: 1,
        DedupCombinations: make(map[string]map[int][]structs.SortValue, 0),
        DedupRecords: make(map[string]map[string]interface{}, 0),
    }

    if limitArr != nil {
        limitStr := limitArr.([]interface{})[1].(string)
        limit, err := strconv.ParseUint(limitStr, 10, 64)
        if err != nil || limit == 0 {
            return nil, fmt.Errorf("Invalid limit (%v): %v", limitStr, err)
        }
        dedupExpr.Limit = limit
    }

    dedupExpr.DedupOptions = &structs.DedupOptions {
        Consecutive: false,
        KeepEmpty: false,
        KeepEvents: false,
    }

    if options1 != nil {
        dedupExpr.DedupOptions = options1.(*structs.DedupOptions)
    }
    if options2 != nil {
        options := options2.(*structs.DedupOptions)

        if options.Consecutive {
            dedupExpr.DedupOptions.Consecutive = options.Consecutive
        }
        if options.KeepEmpty {
            dedupExpr.DedupOptions.KeepEmpty = options.KeepEmpty
        }
        if options.KeepEvents {
            dedupExpr.DedupOptions.KeepEvents = options.KeepEvents
        }
    }

    if sortByClause != nil {
        dedupExpr.DedupSortEles = sortByClause.([]*structs.SortElement)

        // Make the DedupSortAscending from the DedupSortEles.
        dedupExpr.DedupSortAscending = make([]int, len(dedupExpr.DedupSortEles))
        for i, ele := range dedupExpr.DedupSortEles {
            if ele.SortByAsc {
                dedupExpr.DedupSortAscending[i] = 1
            } else {
                dedupExpr.DedupSortAscending[i] = -1
            }
        }
    }

    return dedupExpr, nil
}

DedupFieldName <- !("sortby") field:FieldName {
    return field, nil
}

DedupFieldList <- SPACE first:DedupFieldName rest:(SPACE DedupFieldName !EQUAL)* {
    // Convert `rest` to a slice. Each element of the slice will be a 2-element
    // slice where the first element is " " and the second is a FieldName.
    restSlice := rest.([]any)

    numFieldNames := 1 + len(restSlice)
    fields := make([]string, numFieldNames)
    fields[0] = first.(string)

    for i := 1; i < numFieldNames; i++ {
        separatorAndField := restSlice[i - 1].([]any)
        fields[i] = separatorAndField[1].(string)
    }

    return fields, nil
}

// Optional arguments for dedup block
DedupOptions <- option:(DedupOption)*
{
    //Default value
    options := &structs.DedupOptions {
        Consecutive: false,
        KeepEmpty: false,
        KeepEvents: false,
    }

    optionSlice := option.([]any)
    for _, opt := range optionSlice {
        optArr :=  opt.([]string)
        // Check for matching option types
        switch optArr[0] {
        case "consecutive":
            consecutiveBool, err := strconv.ParseBool(optArr[1])
            if err != nil {
                return nil, fmt.Errorf("Spl peg: DedupBlock: Options: %v", err)
            }
            options.Consecutive = consecutiveBool
        case "keepempty":
            keepEmptyBool, err := strconv.ParseBool(optArr[1])
            if err != nil {
                return nil, fmt.Errorf("Spl peg: DedupBlock: Options: %v", err)
            }
            options.KeepEmpty = keepEmptyBool
        case "keepevents":
            keepEventsBool, err := strconv.ParseBool(optArr[1])
            if err != nil {
                return nil, fmt.Errorf("Spl peg: DedupBlock: Options: %v", err)
            }
            options.KeepEvents = keepEventsBool
        default:
            return nil, fmt.Errorf("Spl peg: DedupBlock: Options: invalid option")
        }
    }

    return options, nil
}

DedupOption <- SPACE optionCMD:DedupOptionCMD "=" field:EvalFieldToRead {
    optionArr := []string{optionCMD.(string), field.(string)}
    return optionArr, nil
}

DedupOptionCMD <- option:("consecutive" / "keepempty" / "keepevents") {
    optionStr, err := transferUint8ToString(option)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: DedupExpr: %v", err)
    }
    return optionStr, nil
}

DedupSortByClause <- CMD_DEDUP_SORTBY dedupSortEles:SortElements {
    return dedupSortEles, nil
}

// sortby ( - | + ) <sort-field> [(- | +) <sort_field> ...]
SortElements <- first:SingleSortElement rest:(EMPTY_OR_COMMA SingleSortElement)* {
    restSlice := rest.([]any)

    length := 1 + len(restSlice)
    sortEles := make([]*structs.SortElement, length)
    sortEles[0] = first.(*structs.SortElement)

    for i := 1; i < length; i++ {
        elements := restSlice[i - 1].([]any)
        sortEles[i] = elements[1].(*structs.SortElement)
    }

    return sortEles, nil
}

SingleSortElement <- element:(SingleSortElementWithCast / SingleSortElementWithoutCast) {
    return element, nil
}

SingleSortElementWithoutCast <- sortBySymbol:("+" / "-" / "") field:FieldName {
    sortByAsc := true

    symbol := sortBySymbol.([]byte)
    if(len(symbol) > 0 && symbol[0] == '-') {
        sortByAsc = false
    }

    return &structs.SortElement {
        SortByAsc: sortByAsc,
        Op: "",
        Field: field.(string),
    }, nil
}

SingleSortElementWithCast <- sortBySymbol:("+" / "-" / "") op:("auto" / "str" / "ip" / "num") L_PAREN field:FieldName R_PAREN {
    sortByAsc := true

    symbol := sortBySymbol.([]byte)
    if(len(symbol) > 0 && symbol[0] == '-') {
        sortByAsc = false
    }

    opStr, err := transferUint8ToString(op)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: singleSortElementWithCast: %v", err)
    }

    return &structs.SortElement {
        SortByAsc: sortByAsc,
        Op: opStr,
        Field: field.(string),
    }, nil
}

RenameBlock <- PIPE CMD_RENAME renameExpr:RenameExpr {
    letColReq := &structs.LetColumnsRequest {
        RenameColRequest: renameExpr.(*structs.RenameExpr),
    }

    root := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            LetColumns: letColReq,
        },
    }

    return root, nil
}

// Rename with a phrase
RenameExpr <- originalPattern:RenamePattern AS newPattern:QuotedString {
    renameExpr := &structs.RenameExpr {
        RenameExprMode: structs.REMPhrase,
        OriginalPattern: originalPattern.(string),
        NewPattern: removeQuotes(newPattern),
    }

    return renameExpr, nil
}
// Rename fields with similar names using a wildcard
// Or Rename to a existing field
/ originalPattern:RenamePattern AS newPattern:RenamePattern {
    isRegex, err := isRegexRename(originalPattern.(string), newPattern.(string))
    if err != nil {
        return nil, fmt.Errorf("Spl peg: RenameExpr: %v", err)
    }

    var renameExprMode structs.RenameExprMode
    if isRegex {
        renameExprMode = structs.REMRegex
    } else {
        renameExprMode = structs.REMOverride
    }

    renameExpr := &structs.RenameExpr {
        RenameExprMode: renameExprMode,
        OriginalPattern: originalPattern.(string),
        NewPattern: newPattern.(string),
    }

    return renameExpr, nil
}

RexBlock <- PIPE CMD_REX "field" EQUAL field:EvalFieldToRead SPACE str:QuotedString {
    pattern := removeQuotes(str)
    rexColNames, err := getRexColNames(pattern)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: RexBlock: %v", err)
    }
    rexExpr := &structs.RexExpr {
        FieldName: field.(string),
        Pattern: transferPCREToRE2(pattern),
        RexColNames: rexColNames,
    }

    letColReq := &structs.LetColumnsRequest {
        RexColRequest: rexExpr,
    }

    root := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            LetColumns: letColReq,
        },
    }

    return root, nil
}

// arguments need to be finished:
// [<count>], [desc]
SortBlock <- PIPE CMD_SORT sortByEles:SortElements {

    sortExpr := &structs.SortExpr {
        SortEles: sortByEles.([]*structs.SortElement),
        SortRecords: make(map[string]map[string]interface{}, 0),
    }

    ascendingArr := make([]int, len(sortExpr.SortEles))
    for i, ele := range sortExpr.SortEles {
        if ele.SortByAsc {
            ascendingArr[i] = 1
        } else {
            ascendingArr[i] = -1
        }
    }

    sortExpr.SortAscending = ascendingArr

    letColReq := &structs.LetColumnsRequest {
        SortColRequest: sortExpr,
    }

    root := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            LetColumns: letColReq,
        },
    }

    return root, nil
}

// Returns *structs.QueryAggregators
EvalBlock <- PIPE CMD_EVAL first:SingleEval rest:(COMMA SingleEval)* {
    root := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            LetColumns: first.(*structs.LetColumnsRequest),
        },
    }

    leafQueryAgg := root
    restSlice := rest.([]any)
    for i := range restSlice {
        CommaSpaceAndEval := restSlice[i].([]any)
        nextQueryAgg := &structs.QueryAggregators {
            PipeCommandType: structs.OutputTransformType,
            OutputTransforms: &structs.OutputTransforms {
                LetColumns: CommaSpaceAndEval[1].(*structs.LetColumnsRequest),
            },
        }

        leafQueryAgg.Next = nextQueryAgg
        leafQueryAgg = leafQueryAgg.Next
    }

    return root, nil
}

// Returns *structs.LetColumnsRequest
SingleEval <- field:FieldName EQUAL expr:EvalExpression {
    fieldStr := field.(string)
    if strings.Contains(fieldStr, "*") {
        return nil, fmt.Errorf("New fields must not contain wildcards; invalid field: %v", field)
    }

    letColumnsRequest := expr.(*structs.LetColumnsRequest)
    letColumnsRequest.NewColName = fieldStr

    return letColumnsRequest, nil
}

// Returns *structs.LetColumnsRequest without the NewColName set.
EvalExpression <- value:ValueExpr {
    letColReq := &structs.LetColumnsRequest {
        ValueColRequest: value.(*structs.ValueExpr),
    }

    return letColReq, nil
}

ConditionExpr <- "if" L_PAREN condition:BoolExpr COMMA trueValue:ValueExpr COMMA falseValue:ValueExpr R_PAREN {

    node := &structs.ConditionExpr {
        Op: "if",
        BoolExpr: condition.(*structs.BoolExpr),
        TrueValue: trueValue.(*structs.ValueExpr),
        FalseValue: falseValue.(*structs.ValueExpr),
    }

    return node, nil
}

TextExpr <- (opName:("lower") L_PAREN stringExpr:StringExpr R_PAREN) {
    opNameStr, err := transferUint8ToString(opName)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: TextExpr: %v", err)
    }
    node := &structs.TextExpr {
        Op: opNameStr,
        Value: stringExpr.(*structs.StringExpr),
        StrToRemove: "",
    }

    return node, nil
}

/ (opName:("max" / "min") L_PAREN firstVal:StringExpr rest:(COMMA StringExpr)* R_PAREN )
      {
        opNameStr, err := transferUint8ToString(opName)
        if err != nil {
            return nil, fmt.Errorf("Spl peg: TextExpr: %v", err)
        }
        if rest == nil {
            return firstVal, nil
        }
        restSlice := rest.([]any)
        values := make([]*structs.StringExpr, 1 + len(restSlice))
        values[0] = firstVal.(*structs.StringExpr)

        for i := range restSlice {
            stringAtom := restSlice[i].([]any)
            values[i + 1] = stringAtom[1].(*structs.StringExpr)
        }
        node := &structs.TextExpr {
            Op: opNameStr,
            MaxMinValues: values,
        }
        return node, nil
      }
/ (opName:("urldecode") L_PAREN url:StringExpr R_PAREN ){
        opNameStr, err := transferUint8ToString(opName)
        if err != nil {
        return nil, fmt.Errorf("Spl peg: TextExpr: %v", err)
    }
        node := &structs.TextExpr {
            Op: opNameStr,
            Value: url.(*structs.StringExpr),
            StrToRemove: "",
        }
        return node, nil
    }
/ (opName:("split") L_PAREN stringExpr:StringExpr COMMA delim:StringExpr R_PAREN) {
    opNameStr, err := transferUint8ToString(opName)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: TextExpr: %v", err)
    }
    node := &structs.TextExpr {
        Op: opNameStr,
        Value: stringExpr.(*structs.StringExpr),
        Delimiter: delim.(*structs.StringExpr),
    }
    return node, nil
}
/ (opName:("substr") L_PAREN stringExpr:StringExpr COMMA startIndex:NumericExpr lengthParam:(COMMA NumericExpr)? R_PAREN) {
    opNameStr, err := transferUint8ToString(opName)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: TextExpr: %v", err)
    }
    stringExprConverted, ok := stringExpr.(*structs.StringExpr)
    if !ok {
        return nil, fmt.Errorf("Spl peg: TextExpr: Failed to assert stringExpr as *structs.StringExpr")
    }
    startIndexConverted, ok := startIndex.(*structs.NumericExpr)
    if !ok {
        return nil, fmt.Errorf("Spl peg: TextExpr: Failed to assert startIndex as *structs.NumericExpr")
    }
  var lengthConverted *structs.NumericExpr
    if lengthParam != nil {
        lengthSlice, ok := lengthParam.([]interface{})
        if ok && len(lengthSlice) > 1 {
            length, ok := lengthSlice[1].(*structs.NumericExpr)
            if ok {
                lengthConverted = length
            } else {
                return nil, fmt.Errorf("Spl peg: TextExpr: Unable to assert length as *structs.NumericExpr")
            }
        }
    }
    node := &structs.TextExpr {
        Op: opNameStr,
        Value: stringExprConverted,
        StartIndex: startIndexConverted,
        LengthExpr: lengthConverted,
    }
    return node, nil
}
/ "tostring" L_PAREN value:ValueExpr format:(COMMA StringExpr )? R_PAREN {
    var formatExpr *structs.StringExpr
    if format != nil {
        formatSlice := format.([]interface{})
        formatExpr, _ = formatSlice[1].(*structs.StringExpr)
    }
    return &structs.TextExpr{
        IsTerminal: false,
        Op:         "tostring",
        Val:        value.(*structs.ValueExpr),
        Format:     formatExpr,
    }, nil
}
/ (opName:("ltrim" / "rtrim") L_PAREN expr:(StringExpr) strToRemoveExpr:(StrToRemoveExpr)? R_PAREN) {
    opNameStr, err := transferUint8ToString(opName)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: TextExpr: %v", err)
    }

    stringExpr, ok := expr.(*structs.StringExpr)
    if !ok {
        return nil, fmt.Errorf("Spl peg: TextExpr: Failed to assert expr as *structs.StringExpr: %v", err)
    }

    strToRemove := " \t"
    if strToRemoveExpr != nil {
        strToRemove = strToRemoveExpr.(string)
    }

    node := &structs.TextExpr {
        Op: opNameStr,
        Value: stringExpr,
        StrToRemove: removeQuotes(strToRemove),
    }

    return node, nil
}

StrToRemoveExpr <- COMMA strToRemove:String {
    return strToRemove, nil
}

// From https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Eval#Syntax
// Returns the field as a string with no quotation marks.
EvalFieldToRead <- [a-zA-Z_]+ !("(") {
    return string(c.text), nil
}
/ "'" field:FieldName "'" {
    return field, nil
}

// Returns *structs.QueryAggregators
WhereBlock <- PIPE CMD_WHERE condition:BoolExpr {
    queryAgg := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            FilterRows: condition.(*structs.BoolExpr),
        },
    }

    return queryAgg, nil
}

// Returns *structs.BoolExpr
BoolExpr <- expr:BoolExprLevel4 {
    return expr, nil
}

// Returns *structs.BoolExpr
BoolExprLevel4 <- first:BoolExprLevel3 rest:(OR BoolExprLevel3)* {
    if rest == nil {
        return first, nil
    }

    cur := first.(*structs.BoolExpr)
    for _, v := range rest.([]any) {
        opAndClause := v.([]any)
        cur = &structs.BoolExpr {
            IsTerminal: false,
            BoolOp: structs.BoolOpOr,
            LeftBool: cur,
            RightBool: opAndClause[1].(*structs.BoolExpr),
        }
    }

    return cur, nil
}

// Returns *structs.BoolExpr
BoolExprLevel3 <- first:BoolExprLevel2 rest:(AND BoolExprLevel2)* {
    if rest == nil {
        return first, nil
    }

    cur := first.(*structs.BoolExpr)
    for _, v := range rest.([]any) {
        opAndClause := v.([]any)
        cur = &structs.BoolExpr {
            IsTerminal: false,
            BoolOp: structs.BoolOpAnd,
            LeftBool: cur,
            RightBool: opAndClause[1].(*structs.BoolExpr),
        }
    }

    return cur, nil
}

// Returns *structs.BoolExpr
BoolExprLevel2 <- NOT L_PAREN first:BoolExprLevel1 R_PAREN {
    cur := &structs.BoolExpr {
        IsTerminal: false,
        BoolOp: structs.BoolOpNot,
        LeftBool: first.(*structs.BoolExpr),
        RightBool: nil,
    }

    return cur, nil
}
/ first:BoolExprLevel1 {
    return first, nil
}

// Returns *structs.BoolExpr
BoolExprLevel1 <- L_PAREN first:BoolExprLevel4 R_PAREN {
    return first, nil
}
/ (op:("isbool" / "isint" / "isstr" / "isnull") L_PAREN value:ValueExpr R_PAREN ) {
    opNameStr, err := transferUint8ToString(op)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: BoolExpr: %v", err)
    }
    expr := &structs.BoolExpr {
        IsTerminal: true,
        LeftValue: value.(*structs.ValueExpr),
        RightValue: nil,
        ValueOp: opNameStr,
    }
    return expr, nil
}
/ likeExpr: LikeExpr {
    return likeExpr, nil
}
LikeExpr <- left:ValueExpr SPACE "LIKE" SPACE right:ValueExpr {
    expr := &structs.BoolExpr {
        IsTerminal: true,
        LeftValue: left.(*structs.ValueExpr),
        RightValue: right.(*structs.ValueExpr),
        ValueOp: "like",
    }
    return expr, nil
}
/ "like" L_PAREN stringr:ValueExpr COMMA pattern:ValueExpr R_PAREN {
     expr := &structs.BoolExpr {
         IsTerminal: true,
         LeftValue: stringr.(*structs.ValueExpr),
         RightValue: pattern.(*structs.ValueExpr),
         ValueOp: "like",
     }
     return expr, nil
 }
/ "match" L_PAREN stringVal:ValueExpr COMMA pattern:ValueExpr R_PAREN {
     expr := &structs.BoolExpr {
         IsTerminal: true,
         LeftValue: stringVal.(*structs.ValueExpr),
         RightValue: pattern.(*structs.ValueExpr),
         ValueOp: "match",
     }
     return expr, nil
 }
/ "cidrmatch" L_PAREN cidr:ValueExpr COMMA ip:ValueExpr R_PAREN {
    expr := &structs.BoolExpr {
        IsTerminal: true,
        LeftValue: cidr.(*structs.ValueExpr),
        RightValue: ip.(*structs.ValueExpr),
        ValueOp: "cidrmatch",
    }
    return expr, nil
}
/ inExpr: InExpr {
    return inExpr, nil
}
/ boolComparisonExpr:BoolComparisonExpr {
    return boolComparisonExpr, nil
}

BoolComparisonExpr <- left:ValueExpr op:EqualityOrInequality right:ValueExpr {
    expr := &structs.BoolExpr {
        IsTerminal: true,
        LeftValue: left.(*structs.ValueExpr),
        RightValue: right.(*structs.ValueExpr),
        ValueOp: op.(string),
    }

    return expr, nil
}


InExpr <- left:ValueExpr SPACE "in" L_PAREN valueToJudge:ValueExpr rest:(COMMA ValueExpr)* R_PAREN {
    restSlice := rest.([]any)
    slice := make([]*structs.ValueExpr, 1 + len(restSlice))
    slice[0] = valueToJudge.(*structs.ValueExpr)

    for i := range restSlice {
        valueAtom := restSlice[i].([]any)
        slice[i + 1] = valueAtom[1].(*structs.ValueExpr)
    }

    expr := &structs.BoolExpr {
        IsTerminal: true,
        LeftValue: left.(*structs.ValueExpr),
        ValueList: slice,
        ValueOp: "in",
    }
    return expr, nil
}
// For this in use case: if(in(<value>, [<list>]), "true_value", "false_value")
/ "in" L_PAREN valueToJudge:ValueExpr rest:(COMMA ValueExpr)* R_PAREN {
    restSlice := rest.([]any)
    slice := make([]*structs.ValueExpr, len(restSlice))

    for i := range restSlice {
        valueAtom := restSlice[i].([]any)
        slice[i] = valueAtom[1].(*structs.ValueExpr)
    }

    expr := &structs.BoolExpr {
        IsTerminal: true,
        LeftValue: valueToJudge.(*structs.ValueExpr),
        ValueList: slice,
        ValueOp: "in",
    }
    return expr, nil
}

// Returns *structs.ValueExpr
//
// The order of the choices is important. In particular, we want to parse a
// single field as a VEMField type ValueExpr so that it can be evaluated to
// either a string or float as needed (if the field has float values), rather
// than parsing it as a NumericExpr or ConcatExpr and forcing it to be a float
// or string respectively.
ValueExpr <- condition:ConditionExpr {

    expr := &structs.ValueExpr {
        ValueExprMode: structs.VEMConditionExpr,
        ConditionExpr: condition.(*structs.ConditionExpr),
    }

    return expr, nil
}
/ L_PAREN (condition:ConditionExpr) R_PAREN {

    expr := &structs.ValueExpr {
        ValueExprMode: structs.VEMConditionExpr,
        ConditionExpr: condition.(*structs.ConditionExpr),
    }

    return expr, nil
}
/ numeric:NumericExpr {

    expr := &structs.ValueExpr {
        ValueExprMode: structs.VEMNumericExpr,
        NumericExpr: numeric.(*structs.NumericExpr),
    }

    return expr, nil
}
/ str:StringExpr {

    expr := &structs.ValueExpr {
        ValueExprMode: structs.VEMStringExpr,
        StringExpr: str.(*structs.StringExpr),
    }

    return expr, nil
}
/ L_PAREN (str:StringExpr) R_PAREN {

    expr := &structs.ValueExpr {
        ValueExprMode: structs.VEMStringExpr,
        StringExpr: str.(*structs.StringExpr),
    }

    return expr, nil
}
/ L_PAREN boolean:BoolExpr R_PAREN {

    expr := &structs.ValueExpr{
        ValueExprMode: structs.VEMBooleanExpr,
        BooleanExpr: boolean.(*structs.BoolExpr),
    }

    return expr, nil
}

StringExpr <- text:TextExpr !(EVAL_CONCAT) {
    expr := &structs.StringExpr {
        StringExprMode: structs.SEMTextExpr,
        TextExpr: text.(*structs.TextExpr),
    }

    return expr, nil
}
/ str:QuotedString !(EVAL_CONCAT) {
    expr := &structs.StringExpr {
        StringExprMode: structs.SEMRawString,
        RawString: removeQuotes(str),
    }

    return expr, nil
}
/ field:EvalFieldToRead !(OpPlus / OpMinus / OpMul / OpDiv / EVAL_CONCAT / "(") {
    expr := &structs.StringExpr {
        StringExprMode: structs.SEMField,
        FieldName: field.(string),
    }

    return expr, nil
}
/ concat:ConcatExpr {
    expr := &structs.StringExpr {
        StringExprMode: structs.SEMConcatExpr,
        ConcatExpr: concat.(*structs.ConcatExpr),
    }

    return expr, nil
}

// Returns *structs.ConcatExpr
ConcatExpr <- first:ConcatAtom rest:(EVAL_CONCAT ConcatAtom)* !(OpPlus / OpMinus / OpMul / OpDiv / "(") {
    restSlice := rest.([]any)
    slice := make([]*structs.ConcatAtom, 1 + len(restSlice))
    slice[0] = first.(*structs.ConcatAtom)

    for i := range restSlice {
        concatAndAtom := restSlice[i].([]any)
        slice[i + 1] = concatAndAtom[1].(*structs.ConcatAtom)
    }

    expr := &structs.ConcatExpr {
        Atoms: slice,
    }

    return expr, nil
}

// Returns *structs.ConcatAtom
ConcatAtom <- text:TextExpr {
    atom := &structs.ConcatAtom {
        IsField: false,
        Value: "",
        TextExpr: text.(*structs.TextExpr),
    }

    return atom, nil
}
/ str:QuotedString {
    atom := &structs.ConcatAtom {
        IsField: false,
        Value: removeQuotes(str),
    }

    return atom, nil
}
/ number:NumberAsString {
    atom := &structs.ConcatAtom {
        IsField: false,
        Value: number.(string),
    }

    return atom, nil
}
/ field:EvalFieldToRead {
    atom := &structs.ConcatAtom {
        IsField: true,
        Value: field.(string),
    }

    return atom, nil
}

// Returns *structs.NumericExpr
NumericExpr <- expr:NumericExprLevel3 !(EVAL_CONCAT / "\"" ) {
    return expr, nil
}

// Returns *structs.NumericExpr
NumericExprLevel3 <- first:NumericExprLevel2 rest:((OpPlus / OpMinus) NumericExprLevel2)* {
    if rest == nil {
        return first, nil
    }

    cur := first.(*structs.NumericExpr)
    for _, v := range rest.([]any) {
        opAndClause := v.([]any)
        cur = &structs.NumericExpr {
            IsTerminal: false,
            Op: opAndClause[0].(string),
            Left: cur,
            Right: opAndClause[1].(*structs.NumericExpr),
            NumericExprMode: structs.NEMNumericExpr,
        }
    }

    return cur, nil
}

// Returns *structs.NumericExpr
NumericExprLevel2 <- first:NumericExprLevel1 rest:((OpMul / OpDiv) NumericExprLevel1)* {
    if rest == nil {
        return first, nil
    }

    cur := first.(*structs.NumericExpr)
    for _, v := range rest.([]any) {
        opAndClause := v.([]any)
        cur = &structs.NumericExpr {
            IsTerminal: false,
            Op: opAndClause[0].(string),
            Left: cur,
            Right: opAndClause[1].(*structs.NumericExpr),
            NumericExprMode: structs.NEMNumericExpr,
        }
    }

    return cur, nil
}

RoundPrecisionExpr <- COMMA expr:NumericExprLevel3 {
    rightNumericExpr, ok := expr.(*structs.NumericExpr)
    if !ok {
        return nil, fmt.Errorf("Failed to assert expr as *structs.NumericExpr")
    }

    return rightNumericExpr, nil
}

// Returns *structs.NumericExpr
NumericExprLevel1 <- L_PAREN expr:NumericExprLevel3 R_PAREN {
    return expr, nil
}
/ numericEvalExpr: NumericEvalExpr {
    return numericEvalExpr, nil
}
/ field:EvalFieldToRead {
    expr := &structs.NumericExpr {
        IsTerminal: true,
        ValueIsField: true,
        Value: field.(string),
        NumericExprMode: structs.NEMNumberField,
    }

    return expr, nil
}
/ number:NumberAsString {
    expr := &structs.NumericExpr {
        IsTerminal: true,
        ValueIsField: false,
        Value: number.(string),
        NumericExprMode: structs.NEMNumber,
    }

    return expr, nil
}

//Currently involves abs, ceil, round, sqrt
NumericEvalExpr <- (opName:("abs" / "ceil" / "sqrt"/ "exact"/ "exp") L_PAREN expr:(NumericExprLevel3) R_PAREN) {
    leftNumericExpr, ok := expr.(*structs.NumericExpr)
    if !ok {
        return nil, fmt.Errorf("Failed to assert expr as *structs.NumericExpr")
    }

    //transfer []uint8 to string
    strData, ok := opName.([]byte)
    if !ok {
        return nil, fmt.Errorf("opName is not a []byte")
    }

    opNameStr := string(strData)
    node, err := createNumericExpr(opNameStr, leftNumericExpr, nil, structs.NEMNumericExpr)
    if err != nil {
        return nil, err
    }

    return node, nil
}
/ roundExpr:"round" L_PAREN expr:(NumericExprLevel3) roundPrecision:(RoundPrecisionExpr)? R_PAREN {
    leftNumericExpr, ok := expr.(*structs.NumericExpr)
    if !ok {
        return nil, fmt.Errorf("Failed to assert expr as *structs.NumericExpr")
    }

    var rightNumericExpr *structs.NumericExpr
    if roundPrecision != nil {
        rightNumericExpr, ok = roundPrecision.(*structs.NumericExpr)
        if !ok {
            return nil, fmt.Errorf("Failed to assert roundPrecision as *structs.NumericExpr")
        }
    }

    node, err := createNumericExpr("round", leftNumericExpr, rightNumericExpr, structs.NEMNumericExpr)
    if err != nil {
        return nil, err
    }

    return node, nil
}
/ "now" "()" {
    return &structs.NumericExpr{
        IsTerminal: true,
        Op:         "now",
    }, nil
}
/ "tonumber" L_PAREN stringExpr:StringExpr baseExpr:(COMMA NumericExprLevel3)? R_PAREN {
    stringExprConverted, ok := stringExpr.(*structs.StringExpr)
    if !ok {
        return nil, fmt.Errorf("Failed to assert stringExpr as *structs.StringExpr")
    }

    var baseExprConverted *structs.NumericExpr
    if baseExpr != nil {
        baseSlice, ok := baseExpr.([]interface{})
        if ok && len(baseSlice) > 1 {
            if base, ok := baseSlice[1].(*structs.NumericExpr); ok {
                baseExprConverted = base
            } else {
                return nil, fmt.Errorf("Failed to assert base as *structs.NumericExpr")
            }
        }
    }

    node := &structs.NumericExpr {
        IsTerminal: false,
        Op: "tonumber",
        Left: nil,
        Right: baseExprConverted,
        Val: stringExprConverted,
        NumericExprMode: structs.NEMNumericExpr,
    }
    return node, nil
}
/ lenExpr: "len" L_PAREN expr:LenExpr R_PAREN {
    return expr, nil
}

LenExpr <- str:QuotedString !(EVAL_CONCAT) {

    leftNumericExpr := &structs.NumericExpr{
        IsTerminal: true,
        ValueIsField: false,
        Value: str.(string),
        NumericExprMode: structs.NEMLenString,
    }

    node, err := createNumericExpr("len", leftNumericExpr, nil, structs.NEMLenString)
    if err != nil {
        return nil, err
    }

    return node, nil
}
/ field:EvalFieldToRead !(OpPlus / OpMinus / OpMul / OpDiv / EVAL_CONCAT / "(") {

    leftNumericExpr := &structs.NumericExpr{
        IsTerminal: true,
        ValueIsField: true,
        Value: field.(string),
        NumericExprMode: structs.NEMLenField,
    }

    node, err := createNumericExpr("len", leftNumericExpr, nil, structs.NEMLenField)
    if err != nil {
        return nil, err
    }

    return node, nil
}

// Returns *structs.QueryAggregators
HeadBlock <- PIPE CMD_HEAD ("limit" EQUAL)? intAsStr:IntegerAsString {
    limit, err := strconv.ParseUint(intAsStr.(string), 10, 64)
    if err != nil {
        return nil, fmt.Errorf("Invalid limit (%v): %v", intAsStr.(string), err)
    }

    queryAgg := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            MaxRows: limit,
        },
    }

    return queryAgg, nil
}
/ PIPE CMD_HEAD_NO_SPACE {
    queryAgg := &structs.QueryAggregators {
        PipeCommandType: structs.OutputTransformType,
        OutputTransforms: &structs.OutputTransforms {
            MaxRows: uint64(10), // From https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Head
        },
    }

    return queryAgg, nil
}

// Parses one or more AggFunctions separated by a comma and space.
// Returns a slice containing all the AggFunctions.
AggregationList <- first:Aggregator rest:((COMMA / SPACE) Aggregator)* {
    // Convert `rest` to a slice. Each element of the slice will be a 2-element
    // slice where the first element is ", " and the second is an Aggregator.
    restSlice := rest.([]any)

    numAggs := 1 + len(restSlice)
    aggsSlice := make([]*aggregator, numAggs)
    aggsSlice[0] = first.(*aggregator)

    for i := 1; i < numAggs; i++ {
        separatorAndAgg := restSlice[i - 1].([]any)
        aggsSlice[i] = separatorAndAgg[1].(*aggregator)
    }

    return aggsSlice, nil
}

Aggregator <- aggFunc:AggFunction asField:AsField? {
    agg := &aggregator{}
    agg.measureAgg = aggFunc.(*structs.MeasureAggregator)

    if asField != nil {
        agg.renameOutputField = true
        agg.outputFieldNewName = asField.(string)
    }

    return agg, nil
}

// For evaluation statements inside aggregate functions:
// 1. min, max, sum, avg, and range can only evaluate boolComparisonExpr, as they need to compute the field value inside the expression. There should be only one field.
// 2. count can evaluate boolExpr because it does not care about the field value inside the expression. It only cares about whether the current row should be counted or not.
// 3. distinctCount and values can evaluate valueExpr because they just need to find out the distinct values of the result of the expression. As for the type of the expression result, it is not important.
AggFunction <- agg:(AggCount / AggDistinctCount / AggAvg / AggMin / AggMax / AggRange / AggSum / AggValues) {
    return agg, nil
}

AsField <- AS field: (FieldName / String) {
    fieldStr := field.(string)

    if strings.Contains(fieldStr, "*") {
        return nil, errors.New("The field specified in `AS` cannot contain wildcards")
    }
    
    if fieldStr[0] == '"' && fieldStr[len(fieldStr)-1] == '"' {
        fieldStr = fieldStr[1 : len(fieldStr)-1]
    }

    return fieldStr, nil
}

AggCount <- ("count" / "c") L_PAREN "eval" boolExpr:BoolExpr R_PAREN {
    valueExpr := &structs.ValueExpr {
        ValueExprMode: structs.VEMBooleanExpr,
        BooleanExpr: boolExpr.(*structs.BoolExpr),
    }

    agg := &structs.MeasureAggregator {
        MeasureCol: "",
        MeasureFunc: utils.Count,
        StrEnc: string(c.text),
        ValueColRequest: valueExpr,
    }

    return agg, nil
}
/ ("count" / "c") L_PAREN field:FieldName R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: field.(string),
        MeasureFunc: utils.Count,
    }

    return agg, nil
} / ("count" / "c") {
    agg := &structs.MeasureAggregator {
        MeasureCol: "*",
        MeasureFunc: utils.Count,
    }

    return agg, nil
}

AggDistinctCount <- ("distinct_count" / "dc") L_PAREN "eval" valueExpr:ValueExpr R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: "",
        MeasureFunc: utils.Cardinality,
        StrEnc: string(c.text),
        ValueColRequest: valueExpr.(*structs.ValueExpr),
    }

    return agg, nil
}
/ ("distinct_count" / "dc") L_PAREN field:FieldName R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: field.(string),
        MeasureFunc: utils.Cardinality,
    }

    return agg, nil
}

AggAvg <- "avg" L_PAREN "eval" L_PAREN boolComparisonExpr:BoolComparisonExpr R_PAREN R_PAREN {
    valueExpr := &structs.ValueExpr {
        ValueExprMode: structs.VEMBooleanExpr,
        BooleanExpr: boolComparisonExpr.(*structs.BoolExpr),
    }

    agg := &structs.MeasureAggregator {
        MeasureCol: "",
        MeasureFunc: utils.Avg,
        StrEnc: string(c.text),
        ValueColRequest: valueExpr,
    }

    return agg, nil
}
/ "avg" L_PAREN field:FieldName R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: field.(string),
        MeasureFunc: utils.Avg,
    }

    return agg, nil
}

AggMin <- "min" L_PAREN "eval" L_PAREN boolComparisonExpr:BoolComparisonExpr R_PAREN R_PAREN {
    valueExpr := &structs.ValueExpr {
        ValueExprMode: structs.VEMBooleanExpr,
        BooleanExpr: boolComparisonExpr.(*structs.BoolExpr),
    }

    agg := &structs.MeasureAggregator {
        MeasureCol: "",
        MeasureFunc: utils.Min,
        StrEnc: string(c.text),
        ValueColRequest: valueExpr,
    }

    return agg, nil
}
/ "min" L_PAREN field:FieldName R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: field.(string),
        MeasureFunc: utils.Min,
    }

    return agg, nil
}

AggMax <- "max" L_PAREN "eval" L_PAREN  boolComparisonExpr:BoolComparisonExpr R_PAREN R_PAREN {
    valueExpr := &structs.ValueExpr {
        ValueExprMode: structs.VEMBooleanExpr,
        BooleanExpr: boolComparisonExpr.(*structs.BoolExpr),
    }

    agg := &structs.MeasureAggregator {
        MeasureCol: "",
        MeasureFunc: utils.Max,
        StrEnc: string(c.text),
        ValueColRequest: valueExpr,
    }

    return agg, nil
}
/ "max" L_PAREN field:FieldName R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: field.(string),
        MeasureFunc: utils.Max,
    }

    return agg, nil
}

AggRange <- "range" L_PAREN "eval" L_PAREN boolComparisonExpr:BoolComparisonExpr R_PAREN R_PAREN {
    valueExpr := &structs.ValueExpr {
        ValueExprMode: structs.VEMBooleanExpr,
        BooleanExpr: boolComparisonExpr.(*structs.BoolExpr),
    }

    agg := &structs.MeasureAggregator {
        MeasureCol: "",
        MeasureFunc: utils.Range,
        StrEnc: string(c.text),
        ValueColRequest: valueExpr,
    }

    return agg, nil
}
/ "range" L_PAREN field:FieldName R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: field.(string),
        MeasureFunc: utils.Range,
    }

    return agg, nil
}

AggSum <- "sum" L_PAREN "eval" L_PAREN boolComparisonExpr:BoolComparisonExpr R_PAREN R_PAREN {
    valueExpr := &structs.ValueExpr {
        ValueExprMode: structs.VEMBooleanExpr,
        BooleanExpr: boolComparisonExpr.(*structs.BoolExpr),
    }

    agg := &structs.MeasureAggregator {
        MeasureCol: "",
        MeasureFunc: utils.Sum,
        StrEnc: string(c.text),
        ValueColRequest: valueExpr,
    }

    return agg, nil
}
/ "sum" L_PAREN field:FieldName R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: field.(string),
        MeasureFunc: utils.Sum,
    }

    return agg, nil
}

AggValues <- "values" L_PAREN "eval" valueExpr:ValueExpr R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: "",
        MeasureFunc: utils.Values,
        StrEnc: string(c.text),
        ValueColRequest: valueExpr.(*structs.ValueExpr),
    }

    return agg, nil
}
/ "values" L_PAREN field:FieldName R_PAREN {
    agg := &structs.MeasureAggregator {
        MeasureCol: field.(string),
        MeasureFunc: utils.Values,
    }

    return agg, nil
}

FieldWithNumberValue <- keyValuePair:(NamedFieldWithNumberValue / UnnamedFieldWithNumberValue) {
    return keyValuePair, nil
}

NamedFieldWithNumberValue <- key:FieldName op:(EqualityOperator / InequalityOperator) value:Number {
    node := &ast.Node{
        NodeType: ast.NodeTerminal,
        Comparison:ast.Comparison{
            Op: op.(string),
            Field: key.(string),
            Values: value,
        },
    }

    return node, nil
}

UnnamedFieldWithNumberValue <- value:Number {
    node := &ast.Node{
        NodeType: ast.NodeTerminal,
        Comparison:ast.Comparison{
            Op: "=",
            Field: "*",
            Values: value,
        },
    }

    return node, nil
}

FieldWithBooleanValue <- key:FieldName op:EqualityOperator value:Boolean {
    node := &ast.Node{
        NodeType: ast.NodeTerminal,
        Comparison:ast.Comparison{
            Op: op.(string),
            Field: key.(string),
            Values: value,
        },
    }

    return node, nil
}

FieldWithStringValue <- keyValuePair:(NamedFieldWithStringValue / UnnamedFieldWithStringValue) {
    return keyValuePair, nil
}

NamedFieldWithStringValue <- key:FieldName op:EqualityOperator value:String {
    node := &ast.Node{
        NodeType: ast.NodeTerminal,
        Comparison:ast.Comparison{
            Op: op.(string),
            Field: key.(string),
            Values: value,
        },
    }
    return node, nil
}

UnnamedFieldWithStringValue <- value:String {
    node := &ast.Node{
        NodeType: ast.NodeTerminal,
        Comparison:ast.Comparison{
            Op: "=",
            Field: "*",
            Values: value,
        },
    }
    return node, nil
}

// Parses one or more FieldNames separated by a comma and space.
// Returns a slice containing all the FieldNames.
FieldNameList <- first:FieldName rest:(COMMA FieldName)* {
    // Convert `rest` to a slice. Each element of the slice will be a 2-element
    // slice where the first element is ", " and the second is a FieldName.
    restSlice := rest.([]any)

    numFieldNames := 1 + len(restSlice)
    fields := make([]string, numFieldNames)
    fields[0] = first.(string)

    for i := 1; i < numFieldNames; i++ {
        separatorAndField := restSlice[i - 1].([]any)
        fields[i] = separatorAndField[1].(string)
    }

    return fields, nil
}

// From https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Aboutregularexpressionswithfieldextractions
// This allows wildcards in a FieldName, but wildcard fields are not allowed in
// some places; those rules should check whether the field has a wildcard.
FieldName <- [a-zA-Z0-9:*][a-zA-Z0-9:_.*]* {
    return string(c.text), nil
}

String <- str:(QuotedString / UnquotedString) {
    return str, nil
}

QuotedString <- '"' [^"]* '"' {
    // The returned string has quotes as the first and last character.
    return string(c.text), nil
}

Boolean <- ("true" / "false") {
    boolValue, _ := strconv.ParseBool(string(c.text))
    return boolValue, nil
}

UnquotedString <- ("*" / (!(MAJOR_BREAK / "|" / EOF) .))+ {
    // Return the string wrapped in quotes.
    str := "\"" + string(c.text) + "\""
    return str, nil
}

//Can recognize fieldName or Regex Pattern for Rename Block
RenamePattern <- [a-zA-Z0-9_*]+ {
    return string(c.text), nil
}

Number <- number:NumberAsString {
    return json.Number(number.(string)), nil
}

// If a number isn't followed by a space, ")", comma, or EOF, we probably want
// to fail and parse it as a string instead.
NumberAsString <- number:(FloatAsString / IntegerAsString) &(SPACE / "|" / ")" / "," / EOF) {
    return number, nil
}

// Allow leading zeros, a "+" before the number, and a decimal point before
// the first digit.
FloatAsString <- [-+]? [0-9]* "." [0-9]+ {
    return string(c.text), nil
}

// Allow leading zeros and a "+" before the number.
IntegerAsString <- [-+]? [0-9]+ {
    return string(c.text), nil
}

EqualityOperator <- EMPTY_OR_SPACE op:("=" / "!=") EMPTY_OR_SPACE {
    opStr, err := transferUint8ToString(op)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: EqualityOperator: %v", err)
    }
    return opStr, nil
}

InequalityOperator <- EMPTY_OR_SPACE op:("<=" / "<" / ">=" / ">") EMPTY_OR_SPACE {
    opStr, err := transferUint8ToString(op)
    if err != nil {
        return nil, fmt.Errorf("Spl peg: InequalityOperator: %v", err)
    }
    return opStr, nil
}

EqualityOrInequality <- op:EqualityOperator {
    return op, nil
}
/ op:InequalityOperator {
    return op, nil
}

OpPlus <- EMPTY_OR_SPACE "+" EMPTY_OR_SPACE {
    return "+", nil
}

OpMinus <- EMPTY_OR_SPACE "-" EMPTY_OR_SPACE {
    return "-", nil
}

OpMul <- EMPTY_OR_SPACE "*" EMPTY_OR_SPACE {
    return "*", nil
}

OpDiv <- EMPTY_OR_SPACE "/" EMPTY_OR_SPACE {
    return "/", nil
}

// Add Empty space here
Second <- ("seconds" / "second" / "secs" / "sec" / "s") {
    return utils.TMSecond, nil
}

Minute <- ("minutes" / "minute" / "mins" / "min" / "m") {
    return utils.TMMinute, nil
}

Hour <- ("hours" / "hour" / "hrs" / "hr" / "h") {
    return utils.TMHour, nil
}

Day <- ("days" / "day" / "d") {
    return utils.TMDay, nil
}

Week <- ("weeks" / "week" / "w") {
    return utils.TMWeek, nil
}

Month <- ("months" / "month" / "mon") {
    return utils.TMMonth, nil
}

Quarter <- ("quarters" / "quarter" / "qtrs" / "qtr" / "q") {
    return utils.TMQuarter, nil
}

// Might not has effect for 'us', because smallest time unit for timestamp in siglens is ms
Subseconds <- ("us" / "ms" / "cs" / "ds") {
    timeUnit, err := utils.ConvertSubseconds(string(c.text))
    if err != nil {
        return nil, fmt.Errorf("Spl peg: Subseconds: %v", err)
    }
    return timeUnit, nil
}

// Returns *structs.QueryAggregators
TransactionBlock <- PIPE CMD_TRANSACTION txnOptions:TransactionOptions {
    queryAgg := &structs.QueryAggregators{
        PipeCommandType: structs.TransactionType,
        TransactionArguments: txnOptions.(*structs.TransactionArguments),
    }
    return queryAgg, nil
}

// The TransactionDefinitionOptionsList will consist of all the Transaction Options
TransactionOptions <- txnOptions:TransactionDefinitionOptionsList?  {

    transactionRequest := &structs.TransactionArguments{}
     
    if txnOptions != nil {
        txnArgs := txnOptions.(*TxnArgs).arguments
        transactionRequest.Fields = txnArgs.Fields
        transactionRequest.StartsWith = txnArgs.StartsWith
        transactionRequest.EndsWith = txnArgs.EndsWith
    }

    return transactionRequest, nil
}


TransactionDefinitionOptionsList <- first:TransactionDefinitionOption rest:(SPACE TransactionDefinitionOption)* {

    restSlice := rest.([]any)
    txnArgs := &TxnArgs{
        argOption: "txn-definition",
        arguments: &structs.TransactionArguments{},
    }

    numArgs := 1 + len(restSlice)

    for i := 0; i < numArgs; i++ {
        var txnArg *TxnArgs
        if i == 0 {
            txnArg = first.(*TxnArgs)
        } else {
            separatorAndArg := restSlice[i - 1].([]any)
            txnArg = separatorAndArg[1].(*TxnArgs)
        }
        argOption := txnArg.argOption

        switch argOption {
            case "fields":
                txnArgs.arguments.Fields = txnArg.arguments.Fields
            case "startswith": 
                txnArgs.arguments.StartsWith = txnArg.arguments.StartsWith
            case "endswith":
                txnArgs.arguments.EndsWith = txnArg.arguments.EndsWith
            default: 
                return nil, fmt.Errorf("Not a Valid Transaction Argument option")
        }
    }

    return txnArgs, nil
}

TransactionDefinitionOption <- option:(SpaceSeparatedFieldNameList / StartsWithOption / EndsWithOption) {
    return option, nil
}

// Parses one or more FieldNames separate by a space
// Returns a slice containing all the FieldNames
SpaceSeparatedFieldNameList <- first:FieldName !(EQUAL) rest:(SPACE FieldName !(EQUAL))* {
    var fields []string
    fields = append(fields, first.(string))
    for _, r := range rest.([]any) {
        // Extracting the field name from the tuple (SPACE, FieldName)
        fields = append(fields, r.([]any)[1].(string))
    }

    txnArg := &TxnArgs{
        argOption: "fields",
        arguments: &structs.TransactionArguments{
            Fields: fields,
        },
    }

    return txnArg, nil
}

StartsWithOption <- "startswith" EQUAL strExpr:TransactionFilterString {
    txnArg := &TxnArgs{
        argOption: "startswith",
        arguments: &structs.TransactionArguments{
            StartsWith: strExpr.(*structs.FilterStringExpr),
        }, 
    }
    return txnArg, nil
}

EndsWithOption <- "endswith" EQUAL strExpr:TransactionFilterString {
    txnArg := &TxnArgs{
        argOption: "endswith",
        arguments: &structs.TransactionArguments{
            EndsWith: strExpr.(*structs.FilterStringExpr),
        },
    }
    return txnArg, nil
}

// Returns structs.FilterStringExpr
TransactionFilterString <- strExpr:(TransactionQuotedString / TransactionEval / TransactionSearch) {
    return strExpr, nil
}

TransactionQuotedString <- str:(TransactionQuotedStringValue / TransactionQuotedStringSearchExpr) {
    return str, nil
}

TransactionQuotedStringSearchExpr <- '"' searchClause:ClauseLevel4 '"' {
    filterStrExpr := &structs.FilterStringExpr{
       SearchNode: searchClause.(*ast.Node),
    }

    return filterStrExpr, nil
}

QuotedStringNoOp <- '"' [^" !(OR / AND)]*  '"' {
    // The returned string has quotes as the first and last character.
    return string(c.text), nil
}

TransactionQuotedStringValue <- str:QuotedStringNoOp {
    filterStrExpr := &structs.FilterStringExpr{
       StringValue: removeQuotes(str.(string)),
    }

    return filterStrExpr, nil
}

TransactionSearch <- expr:ClauseLevel1 {
    
    filterStrExpr := &structs.FilterStringExpr{
       SearchNode: expr.(*ast.Node),
    }

    return filterStrExpr, nil
}

// eval(<bool-expression>)
TransactionEval <- "eval" EMPTY_OR_SPACE L_PAREN condition:BoolExpr R_PAREN {
    filterStrExpr := &structs.FilterStringExpr{
        EvalBoolExpr: condition.(*structs.BoolExpr),
    }

    return filterStrExpr, nil
}


// All cmd expect CMD_SEARCH
ALLCMD <- (CMD_REGEX / CMD_STATS / CMD_FIELDS / CMD_WHERE / CMD_HEAD_NO_SPACE / CMD_HEAD / CMD_EVAL / CMD_REX / CMD_TOP / CMD_RARE / CMD_RENAME / CMD_TIMECHART / CMD_TRANSACTION / CMD_DEDUP / CMD_SORT)
CMD_SEARCH <- "search" SPACE
CMD_REGEX <- "regex" SPACE
CMD_STATS <- "stats" SPACE
CMD_FIELDS <- "fields" SPACE
CMD_WHERE <- "where" SPACE
CMD_HEAD_NO_SPACE <- "head"
CMD_HEAD <- CMD_HEAD_NO_SPACE SPACE
CMD_EVAL <- "eval" SPACE
CMD_REX <- "rex" SPACE
CMD_SORT <- "sort" SPACE
CMD_TOP <- "top"
CMD_RARE <- "rare"
CMD_RENAME <- "rename" SPACE
CMD_TIMECHART <- "timechart" SPACE
CMD_SPAN <- "span"
CMD_TRANSACTION <- "transaction" SPACE
CMD_DEDUP <- "dedup"
CMD_DEDUP_SORTBY <- SPACE "sortby" SPACE
EVAL_CONCAT <- SPACE? "." SPACE?

// Major and Minor breaks from https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Segmentersconf
MAJOR_BREAK <- [[\]<>(){}|!;,'"*\n\r \t&?+] / "%21" / "%26" /
               "%2526" / "%3B" / "%7C" / "%20" / "%2B" / "%3D" / "--" /
               "%2520" / "%5D" / "%5B" / "%3A" / "%0A" / "%2C" / "%28" / "%29"
MINOR_BREAK <- [/:=@.$#%_] / "-" / "\\"

// https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9106
// has some information about case sensitivity.
NOT <- "NOT" SPACE
OR <- SPACE "OR" SPACE
AND <- SPACE "AND" SPACE
PIPE <- EMPTY_OR_SPACE "|" EMPTY_OR_SPACE
AS <- SPACE "AS"i SPACE // Case insensitive
BY <- SPACE "BY"i SPACE // Case insensitive

EQUAL <- EMPTY_OR_SPACE "=" EMPTY_OR_SPACE
COMMA <- EMPTY_OR_SPACE "," EMPTY_OR_SPACE
L_PAREN <- "(" EMPTY_OR_SPACE
R_PAREN <- EMPTY_OR_SPACE ")"

EOF <- !.
SPACE <- (" "? COMMENT " "?) / " "+
COMMENT <- "```" (!("```") .)* "```"
EMPTY_OR_SPACE  <- SPACE / ""
EMPTY_OR_COMMA  <- COMMA / EMPTY_OR_SPACE