I'm working on a really large search right now (on the order of 35 lines long). Is there a good way to insert a comment into a search query to remind a future search editor what is going on?
There doesn't seem to be a | comment
command.
perhaps | rex field=bogus "This could be a comment"
?
Updated Answer for Splunk 6.5.0+
`comment("THIS IS A COMMENT")`
http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Addcommentstosearches
Example from the documentation :
source=usgs `comment("source is the us geological service (usgs)")`
| eval Description=case(depth<=70, "Shallow", depth>70 AND depth<=300, "Mid",
depth>300, "Deep")
`comment("Creates field Description. Case function specifies earthquake
depths, returns Description values - Shallow, Mid, Deep.")`
| stats count min(mag) max(mag) `comment("Counts earthquakes, displays min
and max magnitudes")` BY Description