I'm working on a really large search right now (on the order of 35 lines long). Is there a good way to insert a comment into a search query to remind a future search editor what is going on?
There doesn't seem to be a
| comment command.
| rex field=bogus "This could be a comment" ?
I try to use macros when possible and give both the macros and saved searches names that strongly bely what purpose they serve.
Makes sense. Multiple macros can get very confusing, especially multiple levels of them, to anyone trying to maintain or edit a search. However, the search does have three sections that are repeated, so I will attempt to put that in a single macro.
There is one way that does work and it's pretty simple. Place a rename function at the very end of the search and put all your comments in one long string inside double quotes. Here is the end of a 21 line search followed by a comment:
| table Servers,Access_Status,Access,TM,TD,TDB,MB | rename comment AS "This is a comment. 1. The search should run 2. none of this comment should show"
The search runs but the comment does not show.