Splunk Search

How to put comment on the Splunk Dashboard Studio source?

LearningGuy
Motivator

Hello,
How to put comment on the Splunk Dashboard Studio source?
The classic Splunk Dashboard I can put comment  on the source using <!--  comment  -->
In the new Splunk Dashboard Studio, I tried to put comment using /* comment */, but I got an error "Comments are not permitted in JSON."
The comment only work on the data configuration query editor

Thank you so much

0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

There is no good way to do this.  All you can do is to work around with array, like

{
	"visualizations": {
		"viz_OQMhku6K": {
			"type": "splunk.ellipse",
			"_comment": [
                          "==================================",
                          "This is created by Person1 on 1/1/2023 @companyb",
                          "On 2/1/2023 - added base search",
                          "On 2/5/203  - added dropdown box"
			]
		}
	},

View solution in original post

LearningGuy
Motivator

Your solution worked. Thank you so much for your help

0 Karma

yuanliu
SplunkTrust
SplunkTrust

JSON is data-oriented.  Everything is treated as data.  But just like comment is useless and harmless code in "normal" computing languages, you can think of comment as useless and harmless data in JSON.  The trick is to embed useless data in keys that the application does not reject yet does not utilize.  One trick I found from Stackoverflow (there are many like that) is to place an unusual character at the beginning of key but you can design your own pattern as long as DS doesn't find it objectionable and doesn't act on it.  This example uses "_comment":

{
	"visualizations": {
		"viz_OQMhku6K": {
			"type": "splunk.ellipse",
			"_comment": "about vizualization"
		}
	},
	"dataSources": {
		"_comment": [
			"datasource comment 1",
			"source comment 2"
		]
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		}
	},
	"layout": {
		"type": "absolute",
		"_comment": "something about layout",
		"options": {
			"display": "auto-scale",
			"backgroundImage": {
				"sizeType": "contain",
				"x": 0,
				"y": 0,
				"src": "splunk-enterprise-kvstore://649ab2cf9e8252528a4843f1"
			}
		},
		"structure": [
			{
				"item": "viz_OQMhku6K",
				"type": "block",
				"position": {
					"x": 130,
					"y": 60,
					"w": 130,
					"h": 130
				},
				"_commment": "structure comment here"
			}
		],
		"globalInputs": [
			"input_global_trp"
		]
	},
	"_comment": "general comments go here",
	"description": "",
	"title": "Test Dashboard Studio comment"
}

Hope this helps.

LearningGuy
Motivator

@yuanliu 

Your suggestion worked for me, but is there a way to put comments with Carriage Return in multiple lines?
See below.. Thanks

{
	"visualizations": {
		"viz_OQMhku6K": {
			"type": "splunk.ellipse",
			"_comment": "
                            ==================================
                           This is created by Person1 on 1/1/2023 @companyb
                           On 2/1/2023 - added base search  
                           On 2/5/203  - added dropdown box
                         "
		}
	},

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

There is no good way to do this.  All you can do is to work around with array, like

{
	"visualizations": {
		"viz_OQMhku6K": {
			"type": "splunk.ellipse",
			"_comment": [
                          "==================================",
                          "This is created by Person1 on 1/1/2023 @companyb",
                          "On 2/1/2023 - added base search",
                          "On 2/5/203  - added dropdown box"
			]
		}
	},
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...