I'm working on a really large search right now (on the order of 35 lines long). Is there a good way to insert a comment into a search query to remind a future search editor what is going on?
There doesn't seem to be a
| comment command.
| rex field=bogus "This could be a comment" ?
Updated Answer for Splunk 6.5.0+
`comment("THIS IS A COMMENT")`
Example from the documentation :
source=usgs `comment("source is the us geological service (usgs)")` | eval Description=case(depth<=70, "Shallow", depth>70 AND depth<=300, "Mid", depth>300, "Deep") `comment("Creates field Description. Case function specifies earthquake depths, returns Description values - Shallow, Mid, Deep.")` | stats count min(mag) max(mag) `comment("Counts earthquakes, displays min and max magnitudes")` BY Description
There is one way that does work and it's pretty simple. Place a rename function at the very end of the search and put all your comments in one long string inside double quotes. Here is the end of a 21 line search followed by a comment:
| table Servers,Access_Status,Access,TM,TD,TDB,MB | rename comment AS "This is a comment. 1. The search should run 2. none of this comment should show"
The search runs but the comment does not show.
I downvoted this post because oct 2016 - rename is not the best way to do this any more.
in 6.4 and earlier versions you can create a simple macro to insert comments. as documented here:
in 6.5.0 there is now a built in macro that you can invoke in your searches, as documented here:
Makes sense. Multiple macros can get very confusing, especially multiple levels of them, to anyone trying to maintain or edit a search. However, the search does have three sections that are repeated, so I will attempt to put that in a single macro.