Splunk Search

Custom command description field location

tmaoz
Loves-to-Learn Everything

Hello,

 

I'm using Splunk Enterprise 9.1.2 on my local Linux machine (in a docker container).


When documenting a new custom command in the searchbnf.conf file in my Splunk app, one of the fields is called "description". However, I can't seem to find where this field is actually used?
The command help that pops up when I start typing the command in the search assistant in Splunk Web only shows the "shortdesc" field. This is also true for command from apps installed from SplunkBase.

I'm attaching a screenshot that shows what I see what I start typing a command. In this case I'm using the "summary" command from the Splunk ML app.

The entry in searchbnf.conf is:

[summary-command]
syntax = summary <model_name>
shortdesc = Returns a summary of a machine learning model that was learned using the "fit" command.
description = The summary is algorithm specific. For <LinearRegression>, \
the summary is a list of coefficients. For \
<LogisticRegression>, the summary is a list of \
coefficients for each class.
comment1 = Inspect a previously-learned LinearRegression model, "errors_over_time":
example1 = | summary errors_over_time
usage = public
related = fit apply listmodels deletemodel

As can be seen, only "shortdesc" shows in the little help window that pops up. Is this normal? Is there something to change in some configuration to make the full description show? Is there a different place I can find the full description for the command?

tmaoz_0-1712058392771.png

FYI, the "Learn more" link goes to http://localhost:8000/en-US/help?location=search_app.assist.summary which gets automatically redirected to https://docs.splunk.com/Documentation/MLApp/5.4.1/User/Customsearchcommands?ref=hk#summary. However, for my custom command it gets redirected to https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/3rdpartycustomcommands?ref=hk so not relevant...

Thanks!

Labels (2)
0 Karma

marnall
Motivator

According to the docs for searchbnf.conf, setting the shortdesc field to a value will make it so that the description field only appears when the search assistant is set to "Full" mode.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Searchbnfconf

If you would like description to always appear in that window, and it is not too long, then you could comment out the shortdesc field. Or you could set your user preference so that the Search assistant is in "Full" mode. (User "Preferences"->"SPL Editor"->"Search assistant". It defaults to "Compact")

0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...