Commented code moves in splunk Dashboard

[HattrickNZ]

Has anyone noticed that when you comment out a bit of code in splunk simple XML dashboard, and then save it.
ANd then go back later to edit the same dashboard, the commented out code has moved to the top.

Any one notice this? Can it be made to not happen? I want the code to stay where it is.

I find this useful for comparing an old query chart with an new edited one, but this moving the commented code makes this hard.
Anyone any ideas or suggestions? I guess I could use the clone option but that does not really work for this scenario.

tks

[sapphomo]

This also drives me insane; and comments in the searches themselves is not where I want it. I also never work in the UI editor and it does this sometimes randomly regardless.

[niketn]

@HattrickNZ Except <row> and viz like <table> other comments are retained even on editing. Can you please add code snippet of which place/s are you trying comments? Before and after code?

For me on 8.0.3 only <row> comment got removed and <table> comment got replaced to a place before <options>.

Following is initial code:

<dashboard>
  <label>Dashboard with Comment</label>
  <!-- Some Comment Top -->
  <row>
    <!-- Some Comment Row -->
    <panel>
      <!-- Some Comment Panel -->
      <table>
        <!-- Some Comment Viz -->
        <search>
          <!-- Some Comment Search -->
          <query>
            <!-- Some Comment Query -->
| makeresults count=5
| eval data=random()</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <!-- Some Comment Search Handler -->
            <set token="tokResult">$job.resultCount$</set>
          </done>
        </search>
        <!-- Some Comment Options -->
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <!-- Some comment Drilldown -->
          <set token="tokTest">$click.value2$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Following is simple XML after search was edited from UI. Which means, I can retain most information through comments even if I edited from front-end.

<dashboard>
  <label>Dashboard with Comment</label>
  <!-- Some Comment Top -->
  <row>
    <panel>
      <!-- Some Comment Panel -->
      <table>
        <search>
          <!-- Some Comment Search -->
          <done>
            <!-- Some Comment Search Handler -->
            <set token="tokResult">$job.resultCount$</set>
          </done>
          <query>| makeresults count=5
| eval data=random()
| fields - _time</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <!-- Some Comment Viz -->
        <!-- Some Comment Options -->
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <!-- Some comment Drilldown -->
          <set token="tokTest">$click.value2$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Please add more details if your issue is different. Will recommend you to open a support ticket or submit and idea for better commenting.

[bowesmana]

This happens when you save the dashboard from editing in UI mode - if you want comments to stay, you need to edit in source mode, but I've found that there's always the one save you forget to do and all the comments move...

If you want SPL code comments, then the best option is to create a simple eval based macro that returns "" and use

`c("This is a comment")`

where c is the macro

Don't think there is a way to prevent the move otherwise.

I use the comment all the time in searches, both in dashboards and saved searches, it provides a really good way to document the search and, in particular, the usage of tokens in the search, how they are set and their scope. My understanding is that there is no real cost implication in using this type of eval macro.