topic Re: Add comments to search code inside search field in Splunk Search

Add comments to search code inside search field

sergeblr — Wed, 28 Oct 2020 09:10:10 GMT

Hello everybody, using Splunk 8.1.0 and relaterd to https://docs.splunk.com/Documentation/Splunk/8.1.0/Search/Parsingsearches trying to add comments via ```my_comment``` to search request, but there is error.

Only `comment("my_comment")` works, but it is not what i need...

How to add comment to search request like /* my_comment */ or // my_comment ?

inventsekar — Wed, 28 Oct 2020 10:00:44 GMT

Hi @sergeblr may we know your full search query(after hiding hostname, important field-values) and Splunk version please

sergeblr — Wed, 28 Oct 2020 10:09:23 GMT

index=apps
host=host*
CASE(ERROR) AND "com.*"
```some comment here```

inventsekar — Wed, 28 Oct 2020 10:22:32 GMT

index=apps host=host* ERROR ```some comment here```

are you able to do this search, please check.

sergeblr — Wed, 28 Oct 2020 10:29:47 GMT

Returns

Error in 'SearchParser': You must provide a macro expression.

Splunk 8.0.1

inventsekar — Wed, 28 Oct 2020 10:35:41 GMT

please try this... (this works fine for me)

index=_internal CASE(ERROR) /*test*/

PS - karma points appreciated, if this solves your question, please accept it as the solution. thanks.

sergeblr — Wed, 28 Oct 2020 11:55:34 GMT

For this query /*test*/ parsed as:

'/' symbol, THEN any text (*), THEN 'test' word, THEN again any text (*) and '/' symbol, so this is not parsed as comment :((