Splunk Search

Custom command description field location

tmaoz
Loves-to-Learn Everything

Hello,

 

I'm using Splunk Enterprise 9.1.2 on my local Linux machine (in a docker container).


When documenting a new custom command in the searchbnf.conf file in my Splunk app, one of the fields is called "description". However, I can't seem to find where this field is actually used?
The command help that pops up when I start typing the command in the search assistant in Splunk Web only shows the "shortdesc" field. This is also true for command from apps installed from SplunkBase.

I'm attaching a screenshot that shows what I see what I start typing a command. In this case I'm using the "summary" command from the Splunk ML app.

The entry in searchbnf.conf is:

[summary-command]
syntax = summary <model_name>
shortdesc = Returns a summary of a machine learning model that was learned using the "fit" command.
description = The summary is algorithm specific. For <LinearRegression>, \
the summary is a list of coefficients. For \
<LogisticRegression>, the summary is a list of \
coefficients for each class.
comment1 = Inspect a previously-learned LinearRegression model, "errors_over_time":
example1 = | summary errors_over_time
usage = public
related = fit apply listmodels deletemodel

As can be seen, only "shortdesc" shows in the little help window that pops up. Is this normal? Is there something to change in some configuration to make the full description show? Is there a different place I can find the full description for the command?

tmaoz_0-1712058392771.png

FYI, the "Learn more" link goes to http://localhost:8000/en-US/help?location=search_app.assist.summary which gets automatically redirected to https://docs.splunk.com/Documentation/MLApp/5.4.1/User/Customsearchcommands?ref=hk#summary. However, for my custom command it gets redirected to https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/3rdpartycustomcommands?ref=hk so not relevant...

Thanks!

Labels (2)
0 Karma

marnall
Builder

According to the docs for searchbnf.conf, setting the shortdesc field to a value will make it so that the description field only appears when the search assistant is set to "Full" mode.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Searchbnfconf

If you would like description to always appear in that window, and it is not too long, then you could comment out the shortdesc field. Or you could set your user preference so that the Search assistant is in "Full" mode. (User "Preferences"->"SPL Editor"->"Search assistant". It defaults to "Compact")

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...