Splunk Search

Custom command description field location

tmaoz
Loves-to-Learn Everything

Hello,

 

I'm using Splunk Enterprise 9.1.2 on my local Linux machine (in a docker container).


When documenting a new custom command in the searchbnf.conf file in my Splunk app, one of the fields is called "description". However, I can't seem to find where this field is actually used?
The command help that pops up when I start typing the command in the search assistant in Splunk Web only shows the "shortdesc" field. This is also true for command from apps installed from SplunkBase.

I'm attaching a screenshot that shows what I see what I start typing a command. In this case I'm using the "summary" command from the Splunk ML app.

The entry in searchbnf.conf is:

[summary-command]
syntax = summary <model_name>
shortdesc = Returns a summary of a machine learning model that was learned using the "fit" command.
description = The summary is algorithm specific. For <LinearRegression>, \
the summary is a list of coefficients. For \
<LogisticRegression>, the summary is a list of \
coefficients for each class.
comment1 = Inspect a previously-learned LinearRegression model, "errors_over_time":
example1 = | summary errors_over_time
usage = public
related = fit apply listmodels deletemodel

As can be seen, only "shortdesc" shows in the little help window that pops up. Is this normal? Is there something to change in some configuration to make the full description show? Is there a different place I can find the full description for the command?

tmaoz_0-1712058392771.png

FYI, the "Learn more" link goes to http://localhost:8000/en-US/help?location=search_app.assist.summary which gets automatically redirected to https://docs.splunk.com/Documentation/MLApp/5.4.1/User/Customsearchcommands?ref=hk#summary. However, for my custom command it gets redirected to https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/3rdpartycustomcommands?ref=hk so not relevant...

Thanks!

Labels (2)
0 Karma

marnall
Motivator

According to the docs for searchbnf.conf, setting the shortdesc field to a value will make it so that the description field only appears when the search assistant is set to "Full" mode.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Searchbnfconf

If you would like description to always appear in that window, and it is not too long, then you could comment out the shortdesc field. Or you could set your user preference so that the Search assistant is in "Full" mode. (User "Preferences"->"SPL Editor"->"Search assistant". It defaults to "Compact")

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...