Splunk Search

Add comments to search code inside search field

sergeblr
Explorer

Hello everybody, using Splunk 8.1.0 and relaterd to https://docs.splunk.com/Documentation/Splunk/8.1.0/Search/Parsingsearches trying to add comments via ```my_comment``` to search request, but there is error.

Only `comment("my_comment")` works, but it is not what i need...

How to add comment to search request like /* my_comment */ or // my_comment ?

inventsekar
SplunkTrust
SplunkTrust

Hi @sergeblr may we know your full search query(after hiding hostname, important field-values) and Splunk version please

0 Karma

sergeblr
Explorer

Hi, @inventsekar 

index=apps
host=host*
CASE(ERROR) AND "com.*"
```some comment here```

inventsekar
SplunkTrust
SplunkTrust
index=apps host=host* ERROR  ```some comment here```

are you able to do this search, please check.

0 Karma

sergeblr
Explorer

Безымянный.pngReturns

 

Error in 'SearchParser': You must provide a macro expression.

 

Splunk 8.0.1

inventsekar
SplunkTrust
SplunkTrust

please try this... (this works fine for me)

 

index=_internal CASE(ERROR) /*test*/

 

PS  - karma points appreciated, if this solves your question, please accept it as the solution. thanks.

 

0 Karma

sergeblr
Explorer

For this query /*test*/ parsed as:

'/' symbol, THEN any text (*), THEN 'test' word, THEN again any text (*) and '/' symbol, so this is not parsed as comment :((

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...