Is there a way to make Splunk Search Language more readable?

[jaredlaney]

I'm looking for ideas on ways to make Splunk searches more modular and readable. Yes. I just inherited some dashboards where the search for one panel takes up half of the screen.

1. Is there a way to retain white space in saved searches?
2. Imagine I can use a base search or saved search
3. Are macros a good idea? Sometimes they seem to be hard to find and alter

Maybe someone has written a good style guide or convention guide for Splunk search language?

[efavreau]

A large time has passed since the question, but in case other stumble across, here are some pointers. The short answer is, Yes, there are ways to make SPL more readable.

Splunk will preserve the whitespace you put in.

Improved readability of SPL has been built into Splunk 6.6:
http://docs.splunk.com/Documentation/Splunk/7.2.0/Search/Parsingsearches
this includes line number, syntax highlighting, keyboard shortcut for formatting SPL, etc.

Comments are built into 6.5.0+ as a macro, and can be leveraged in your SPL:
https://answers.splunk.com/answers/48865/add-a-comment-to-a-search.html

Macros used to be difficult to use and look up, but since 6.6, you can use the macro expansion keyboard shortcut, and fear them no more:
https://answers.splunk.com/answers/471235/how-to-expand-macros-in-a-splunk-search.html

[javiergn]

I know it's not nice but one of the things I'm finding more useful with long and complex searches are comments and comments are not supported in the query language so this is what I usually include instead:

| eval comment1 = "
    #
    # the code below is doing X, Y, Z
    #
"
| verycomplexcode doing X, Y, Z
| eval comment2 =  "
    #
    # the code below is doing A, B, C
    #
"
| verycomplexcode doing A, B, C
....
| fields - comment*

Another thing I found extremely useful in order to make your queries more readable is to add new lines before you pipe a command (see above) or extra indentation for subsearches, joins, etc (anything that requires square brackets).