https://docs.splunk.com/Documentation/SCS/current/Search/Comments says that we may use block comments or line comments in SPL2.
When trying to learn how to count the number of objects in a JSON array returned from json_extract, I came across this post, which has an extended multiline splunk query. I wanted to see how the command worked, so I tried using both block and line comments to comment out the end of the query and replace it with a comand to view the intermediate output, e.g.
index=_internal | head 1 | fields _raw _time | eval _raw="{
\"cities\": [
{
\"name\": \"London\",
\"Bridges\": [
{ \"name\": \"Tower Bridge\", \"length\": 801 },
{ \"name\": \"Millennium Bridge\", \"length\": 1066 }
]
},
{
\"name\": \"Venice\",
\"Bridges\": [
{ \"name\": \"Rialto Bridge\", \"length\": 157 },
{ \"name\": \"Bridge of Sighs\", \"length\": 36 },
{ \"name\": \"Ponte della Paglia\" }
]
},
{
\"name\": \"San Francisco\",
\"Bridges\": [
{ \"name\": \"Golden Gate Bridge\", \"length\": 8981 },
{ \"name\": \"Bay Bridge\", \"length\": 23556 }
]
}
]
}"
| rename COMMENT as "the logic"
| spath cities{} output=cities
/*
| stats count by cities
| spath input=cities Bridges{} output=Bridges
| mvexpand Bridges
| spath input=cities name output=city
| spath input=Bridges
| table city name length
*/
| table cities
Both commenting schemes generate an error:
If you're not in Dashboard Studio then SPL2 doesn't apply.
To comment out code in SPL, use triple-backticks.
index=_internal | head 1 | fields _raw _time | eval _raw="{
\"cities\": [
{
\"name\": \"London\",
\"Bridges\": [
{ \"name\": \"Tower Bridge\", \"length\": 801 },
{ \"name\": \"Millennium Bridge\", \"length\": 1066 }
]
},
{
\"name\": \"Venice\",
\"Bridges\": [
{ \"name\": \"Rialto Bridge\", \"length\": 157 },
{ \"name\": \"Bridge of Sighs\", \"length\": 36 },
{ \"name\": \"Ponte della Paglia\" }
]
},
{
\"name\": \"San Francisco\",
\"Bridges\": [
{ \"name\": \"Golden Gate Bridge\", \"length\": 8981 },
{ \"name\": \"Bay Bridge\", \"length\": 23556 }
]
}
]
}"
| rename COMMENT as "the logic"
| spath cities{} output=cities
```
| stats count by cities
| spath input=cities Bridges{} output=Bridges
| mvexpand Bridges
| spath input=cities name output=city
| spath input=Bridges
| table city name length
```
| table cities