Splunk Search

How can we define -- to be a comment?

danielbb
Motivator

We would like to set -- to be a comment in SPL. Can we do that and if so what's needed. We are on 7.3.

Tags (1)
0 Karma

mayurr98
Super Champion

Hey,

Yes, you can definitely do that usingcomment("comment text")

Have a look at this :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/Addcommentstosearches

jpolvino
Builder

We use this a lot, and it is "ok" as far as adding some information to searches. I can fully understand the desire to have more robust commenting.

0 Karma

danielbb
Motivator

But, is there a way to define, let's say, -- as a comment line?

0 Karma

mayurr98
Super Champion

I don’t think so, as of now there is only this way to comment text

0 Karma

danielbb
Motivator

Really - too sad.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...