Hello,   I'm using Splunk Enterprise 9.1.2 on my local Linux machine (in a docker container). When documenting a new custom command in the searchbnf.conf file in my Splunk app, one of the fields is called "description". However, I can't seem to find where this field is actually used? The command help that pops up when I start typing the command in the search assistant in Splunk Web only shows the "shortdesc" field. This is also true for command from apps installed from SplunkBase. I'm attaching a screenshot that shows what I see what I start typing a command. In this case I'm using the "summary" command from the Splunk ML app. The entry in searchbnf.conf is: [summary-command] syntax = summary <model_name> shortdesc = Returns a summary of a machine learning model that was learned using the "fit" command. description = The summary is algorithm specific. For <LinearRegression>, \ the summary is a list of coefficients. For \ <LogisticRegression>, the summary is a list of \ coefficients for each class. comment1 = Inspect a previously-learned LinearRegression model, "errors_over_time": example1 = | summary errors_over_time usage = public related = fit apply listmodels deletemodel As can be seen, only "shortdesc" shows in the little help window that pops up. Is this normal? Is there something to change in some configuration to make the full description show? Is there a different place I can find the full description for the command? FYI, the "Learn more" link goes to http://localhost:8000/en-US/help?location=search_app.assist.summary which gets automatically redirected to https://docs.splunk.com/Documentation/MLApp/5.4.1/User/Customsearchcommands?ref=hk#summary. However, for my custom command it gets redirected to https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/3rdpartycustomcommands?ref=hk so not relevant... Thanks! ... View more

Hello,   I have a CSV file with many MANY columns (in my case there are 7334 columns with an average length of 145-146 chars each. This is a telemetry file exported from some networking equipment and this is just part of the exported data... The file has over 1000 data rows but I'm just trying to add 5 rows at the moment. Trying to create an input for the file fails when adding more that 4175 columns with the following error: "Accumulated a line of 512256 bytes while reading a structured header, giving up parsing header" I have already tried to increase all TRUNCATION settings to well above this value (several orders of magnitude) as well as the "[kv]" limits in the "limits.conf" file. Nothing helps. I searched the forum here but couldn't find anything relevant. A Google search yielded two results, one where people just decided that headers that are too long are the user's problem and did not offer any resolution (not even to say it's not possible). The other result just went unanswered. Couldn't find anything relevant in the Splunk online documentation or REST API specifications either. I will also mention that processing the full data file with Python using either the standard csv parser or Pandas works just fine and very quickly. The total file size is ~92MB which is not big at all IMHO. My Splunk info: Version:9.1.2 Build:b6b9c8185839 Server:834f30dfffad Products:hadoop Needless to say the web frontend crashes entirely when I try to create the input so I'm doing everything via the Python SDK now. Any ideas if this can be fixed to I can add all of my data? ... View more