topic Re: Splunk should upgrade the `noop` command to take a single string parameter (making it a `comment` command) and then document it! in Splunk Search

Splunk should upgrade the `noop` command to take a single string parameter (making it a `comment` command) and then document it!

woodcock — Mon, 08 Jun 2015 06:07:57 GMT

I just discovered the interesting noop command and have been playing around with it. I cannot find it mentioned ANYWHERE! I was hoping that it would take a single string parameter so that it would act as a comment command like this:

... | noop "My comment here - Jesus is the only way to be reconciled to God: repent of all sin and trust Him as your Savior, then read your Bible every day and do what the Holy Spirit convicts you to do!" | ...

This comment functionality should be implemented; it would be very useful to many people and is long overdue.

Re: Splunk should upgrade the `noop` command to take a single string parameter (making it a `comment` command) and then document it!

richgalloway — Mon, 08 Jun 2015 12:11:06 GMT

I agree with the usefulness of a comment command. As a workaround, I use eval comment="What I'm trying to do here".

Re: Splunk should upgrade the `noop` command to take a single string parameter (making it a `comment` command) and then document it!

acharlieh — Mon, 08 Jun 2015 16:37:44 GMT

noop is indeed a fun one. I originally found it myself digging through how certain distributed queries were working with the job inspector. I've seen people use the actually documented localop for similar purposes of mocking out search data as well.

I agree that comment is a feature missing from the SPL, it'd be nice to be able to paste long search strings here and be able to have inline comments explaining certain pieces, while still letting others copy and paste the search as a whole including comments into their splunk instances to try things out.

That said there are a number of interesting workarounds found on this older answer thread and @ewoo's answer adding a macro that wraps the noop command and throws away the argument may be just what you're looking for. (That way we preserve the semantics of this No Operation, and with the name of the macro we clearly indicate to the user what's happening)

As pointed out on the other thread, he downside to using eval as suggested by @richgalloway is that you wind up adding a field to every event in your result set (or intermediate result set) which could be a lot of processing depending on how many events you have at the time.

While the macro solution as it stands is interesting, I also have to wonder if there's a possibility of a eval-based macro, or macro that returns nothing, so that inline comments become possible without changing impact of them within commands as well.

... | rename *_bear as *_wolf `comment("the input fields are off and we need to correlate them")` moose as squirrel `comment("Ok this is just a bad joke")`

Re: Splunk should upgrade the `noop` command to take a single string parameter (making it a `comment` command) and then document it!

woodcock — Wed, 10 Jun 2015 21:20:11 GMT

Splunk Case 245041 Splunk "noop" command totally undocumented has been filed as bug SPL-102993 to add noop to the list of search commands here:

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/ListOfSearchCommands

Re: Splunk should upgrade the `noop` command to take a single string parameter (making it a `comment` command) and then document it!

lstewart_splunk — Tue, 13 Oct 2015 19:34:33 GMT

The noop command is an internal command used by Splunk for debugging.

If you want to add comments to your search strings, anywhere in the search string, use the method mentioned by steveyz in this Answer
https://answers.splunk.com/answers/48865/add-a-comment-to-a-search.html

It is also now documented in the Search Manual:
http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Addcommentstosearches