Splunk Search

Add/change comments and descriptions into objects' fields in an existing data model

ntttmttoro
New Member

How do you add comments and descriptions into objects' fields in an existing data model WITHOUT manually edit the data model's JSON file?
Can you add/change the comments/descriptions in the objects' fields through the Splunk GUI interface? if you do, please tell me how you do it.
The splunk help page states that the only way to add/change the comments and descriptions into objects' fields in an existing data model is to modify the data model's json file.

Optional fields

objects.comment.description
Syntax: $.objects[*].comment.description
Description:: The description of the data model.

object.fields.comment.description
Syntax: $.object[].fields[].comment.description:
Description:: The description of the data model field.

object.fields.comment.expected_values
Syntax: $.object[].fields[].comment.expected_values:
Description:: It defines the expected value(s) of the data model field. Splunk add-on builder verifies the expect value(s) when user validates the add-on.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...