I'm working on a really large search right now (on the order of 35 lines long). Is there a good way to insert a comment into a search query to remind a future search editor what is going on?
There doesn't seem to be a | comment
command.
perhaps | rex field=bogus "This could be a comment"
?
Updated Answer for Splunk 6.5.0+
`comment("THIS IS A COMMENT")`
http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Addcommentstosearches
Example from the documentation :
source=usgs `comment("source is the us geological service (usgs)")`
| eval Description=case(depth<=70, "Shallow", depth>70 AND depth<=300, "Mid",
depth>300, "Deep")
`comment("Creates field Description. Case function specifies earthquake
depths, returns Description values - Shallow, Mid, Deep.")`
| stats count min(mag) max(mag) `comment("Counts earthquakes, displays min
and max magnitudes")` BY Description
We use a SVN repository to document all our Splunk queries we have in production.
There is one way that does work and it's pretty simple. Place a rename function at the very end of the search and put all your comments in one long string inside double quotes. Here is the end of a 21 line search followed by a comment:
| table Servers,Access_Status,Access,TM,TD,TDB,MB
| rename comment AS "This is a comment.
1. The search should run
2. none of this comment should show"
The search runs but the comment does not show.
I downvoted this post because outdated solution.
I downvoted this post because oct 2016 - rename is not the best way to do this any more.
in 6.4 and earlier versions you can create a simple macro to insert comments. as documented here:
http://docs.splunk.com/Documentation/Splunk/6.4.3/Search/Addcommentstosearches
in 6.5.0 there is now a built in macro that you can invoke in your searches, as documented here:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Addcommentstosearches
I have fixed the links
@lstewart_splunk, your links don't work
I would think it uses fewer clocks than the eval.
Nice. This looks like the least work for Splunk to do as part of a search
Clever! I like it.
or maybe | rex field=comment "(?#This is a comment)"
?
That's a pretty cool idea! Today, I don't think there is any such mechanism, and I wouldn't recommend using rex as such 🙂
...and then make a long search even longer 🙂
Agreed, macros can get pretty confusing and there is no way to in-line comment searches, which would be very cool.
But the question of how to best add a comment to a search, in the absence of a |comment
, is still open.
Makes sense. Multiple macros can get very confusing, especially multiple levels of them, to anyone trying to maintain or edit a search. However, the search does have three sections that are repeated, so I will attempt to put that in a single macro.
I try to use macros when possible and give both the macros and saved searches names that strongly bely what purpose they serve.
What would you recommend then?