We would like to set --
to be a comment in SPL. Can we do that and if so what's needed. We are on 7.3.
Hey,
Yes, you can definitely do that usingcomment("comment text")
Have a look at this :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/Addcommentstosearches
We use this a lot, and it is "ok" as far as adding some information to searches. I can fully understand the desire to have more robust commenting.
But, is there a way to define, let's say, --
as a comment line?
I don’t think so, as of now there is only this way to comment text
Really - too sad.