I just discovered the interesting
noop command and have been playing around with it. I cannot find it mentioned ANYWHERE! I was hoping that it would take a single
string parameter so that it would act as a
comment command like this:
... | noop "My comment here - Jesus is the only way to be reconciled to God: repent of all sin and trust Him as your Savior, then read your Bible every day and do what the Holy Spirit convicts you to do!" | ...
comment functionality should be implemented; it would be very useful to many people and is long overdue.
I agree with the usefulness of a
comment command. As a workaround, I use
eval comment="What I'm trying to do here".
noop is indeed a fun one. I originally found it myself digging through how certain distributed queries were working with the job inspector. I've seen people use the actually documented localop for similar purposes of mocking out search data as well.
I agree that comment is a feature missing from the SPL, it'd be nice to be able to paste long search strings here and be able to have inline comments explaining certain pieces, while still letting others copy and paste the search as a whole including comments into their splunk instances to try things out.
That said there are a number of interesting workarounds found on this older answer thread and @ewoo's answer adding a macro that wraps the noop command and throws away the argument may be just what you're looking for. (That way we preserve the semantics of this No Operation, and with the name of the macro we clearly indicate to the user what's happening)
As pointed out on the other thread, he downside to using eval as suggested by @richgalloway is that you wind up adding a field to every event in your result set (or intermediate result set) which could be a lot of processing depending on how many events you have at the time.
While the macro solution as it stands is interesting, I also have to wonder if there's a possibility of a eval-based macro, or macro that returns nothing, so that inline comments become possible without changing impact of them within commands as well.
... | rename *_bear as *_wolf `comment("the input fields are off and we need to correlate them")` moose as squirrel `comment("Ok this is just a bad joke")`
Splunk Case 245041
Splunk "noop" command totally undocumented has been filed as bug
SPL-102993 to add
noop to the list of search commands here:
The noop command is an internal command used by Splunk for debugging.
If you want to add comments to your search strings, anywhere in the search string, use the method mentioned by steveyz in this Answer
It is also now documented in the Search Manual: