Splunk Search

How to put comment on the Splunk Dashboard Studio source?

LearningGuy
Motivator

Hello,
How to put comment on the Splunk Dashboard Studio source?
The classic Splunk Dashboard I can put comment  on the source using <!--  comment  -->
In the new Splunk Dashboard Studio, I tried to put comment using /* comment */, but I got an error "Comments are not permitted in JSON."
The comment only work on the data configuration query editor

Thank you so much

0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

There is no good way to do this.  All you can do is to work around with array, like

{
	"visualizations": {
		"viz_OQMhku6K": {
			"type": "splunk.ellipse",
			"_comment": [
                          "==================================",
                          "This is created by Person1 on 1/1/2023 @companyb",
                          "On 2/1/2023 - added base search",
                          "On 2/5/203  - added dropdown box"
			]
		}
	},

View solution in original post

LearningGuy
Motivator

Your solution worked. Thank you so much for your help

0 Karma

yuanliu
SplunkTrust
SplunkTrust

JSON is data-oriented.  Everything is treated as data.  But just like comment is useless and harmless code in "normal" computing languages, you can think of comment as useless and harmless data in JSON.  The trick is to embed useless data in keys that the application does not reject yet does not utilize.  One trick I found from Stackoverflow (there are many like that) is to place an unusual character at the beginning of key but you can design your own pattern as long as DS doesn't find it objectionable and doesn't act on it.  This example uses "_comment":

{
	"visualizations": {
		"viz_OQMhku6K": {
			"type": "splunk.ellipse",
			"_comment": "about vizualization"
		}
	},
	"dataSources": {
		"_comment": [
			"datasource comment 1",
			"source comment 2"
		]
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		}
	},
	"layout": {
		"type": "absolute",
		"_comment": "something about layout",
		"options": {
			"display": "auto-scale",
			"backgroundImage": {
				"sizeType": "contain",
				"x": 0,
				"y": 0,
				"src": "splunk-enterprise-kvstore://649ab2cf9e8252528a4843f1"
			}
		},
		"structure": [
			{
				"item": "viz_OQMhku6K",
				"type": "block",
				"position": {
					"x": 130,
					"y": 60,
					"w": 130,
					"h": 130
				},
				"_commment": "structure comment here"
			}
		],
		"globalInputs": [
			"input_global_trp"
		]
	},
	"_comment": "general comments go here",
	"description": "",
	"title": "Test Dashboard Studio comment"
}

Hope this helps.

LearningGuy
Motivator

@yuanliu 

Your suggestion worked for me, but is there a way to put comments with Carriage Return in multiple lines?
See below.. Thanks

{
	"visualizations": {
		"viz_OQMhku6K": {
			"type": "splunk.ellipse",
			"_comment": "
                            ==================================
                           This is created by Person1 on 1/1/2023 @companyb
                           On 2/1/2023 - added base search  
                           On 2/5/203  - added dropdown box
                         "
		}
	},

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

There is no good way to do this.  All you can do is to work around with array, like

{
	"visualizations": {
		"viz_OQMhku6K": {
			"type": "splunk.ellipse",
			"_comment": [
                          "==================================",
                          "This is created by Person1 on 1/1/2023 @companyb",
                          "On 2/1/2023 - added base search",
                          "On 2/5/203  - added dropdown box"
			]
		}
	},
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...