Splunk Search

Custom command description field location

tmaoz
Loves-to-Learn Everything

Hello,

 

I'm using Splunk Enterprise 9.1.2 on my local Linux machine (in a docker container).


When documenting a new custom command in the searchbnf.conf file in my Splunk app, one of the fields is called "description". However, I can't seem to find where this field is actually used?
The command help that pops up when I start typing the command in the search assistant in Splunk Web only shows the "shortdesc" field. This is also true for command from apps installed from SplunkBase.

I'm attaching a screenshot that shows what I see what I start typing a command. In this case I'm using the "summary" command from the Splunk ML app.

The entry in searchbnf.conf is:

[summary-command]
syntax = summary <model_name>
shortdesc = Returns a summary of a machine learning model that was learned using the "fit" command.
description = The summary is algorithm specific. For <LinearRegression>, \
the summary is a list of coefficients. For \
<LogisticRegression>, the summary is a list of \
coefficients for each class.
comment1 = Inspect a previously-learned LinearRegression model, "errors_over_time":
example1 = | summary errors_over_time
usage = public
related = fit apply listmodels deletemodel

As can be seen, only "shortdesc" shows in the little help window that pops up. Is this normal? Is there something to change in some configuration to make the full description show? Is there a different place I can find the full description for the command?

tmaoz_0-1712058392771.png

FYI, the "Learn more" link goes to http://localhost:8000/en-US/help?location=search_app.assist.summary which gets automatically redirected to https://docs.splunk.com/Documentation/MLApp/5.4.1/User/Customsearchcommands?ref=hk#summary. However, for my custom command it gets redirected to https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/3rdpartycustomcommands?ref=hk so not relevant...

Thanks!

Labels (1)
0 Karma

marnall
Motivator

According to the docs for searchbnf.conf, setting the shortdesc field to a value will make it so that the description field only appears when the search assistant is set to "Full" mode.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Searchbnfconf

If you would like description to always appear in that window, and it is not too long, then you could comment out the shortdesc field. Or you could set your user preference so that the Search assistant is in "Full" mode. (User "Preferences"->"SPL Editor"->"Search assistant". It defaults to "Compact")

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...