Add comments to a search

The most flexible way to add comments to your search strings is to create a macro. You can use the macro multiple times in your search string and multiple times in a single command string. Comments in a search do not impact search performance.

You can create the macro in Splunk Web or, in Splunk Enterprise, by editing the macros.conf file.

Create a comment macro in Splunk Web

1. In Splunk Web, select Settings > Advanced Search > Search macros.
2. Verify that App context is set to Search & Reporting (search).
3. Click New to create a new search macro.
4. For Destination app, select search.
5. For Name, type comment(1).
6. For Definition, type "" (two double quotation marks).
7. Mark the Use eval-based definition? checkbox.
8. For Arguments, type text.
9. Click Save.

Create a comment macro in the macros.conf file

In the macros.conf file, add the following macro.

[comment(1)]
  args = text
  definition = ""
  iseval = 1

Using the comment macro

You can use the comment macro to add comments anywhere in your search string. The syntax for your comment is `comment("comment text")`.

Examples

`comment("THIS IS A COMMENT")`

`comment("This part of the search returns only one value")`

Comments begin and end with the back quote, or grave accent, character.

Examples

Adding comments to a search

This search classifies recent earthquakes based on their depth.

source=usgs 
| eval Description=case(depth<=70, "Shallow", depth>70 AND depth<=300,  "Mid", 
  depth>300, "Deep") 
| stats count min(mag) max(mag) BY Description

When you add inline comments the search is easier to understand.

source=usgs `comment("source is the us geological service (usgs)")`
| eval Description=case(depth<=70, "Shallow", depth>70 AND depth<=300, "Mid", 
  depth>300, "Deep") 
  `comment("Creates field Description. Case function specifies earthquake 
  depths, returns Description values - Shallow, Mid, Deep.")`
| stats count min(mag) max(mag) `comment("Counts earthquakes, displays min 
  and max magnitudes")` BY Description 

Consider using uppercase characters for your comments to make them easier to find.

source=usgs `comment("SOURCE IS THE US GEOLOGICAL SERVICE (USGS)")`
| eval Description=case(depth<=70, "Shallow", depth>70 AND depth<=300, "Mid", 
  depth>300, "Deep") 
  `comment("CREATES FIELD DESCRIPTION. CASE FUNCTION SPECIFIES EARTHQUAKE DEPTHS, RETURNS DESCRIPTION VALUES - SHALLOW, MID, DEEP.")`
| stats count min(mag) max(mag) `comment("COUNTS EARTHQUAKES, DISPLAYS MIN AND MAX MAGNITUDES")` BY Description 

Using comments to troubleshoot a search

The following search is attempting to return the bytes for the individual indexes. However, the search has the wrong field in the stats command <split-by clause>.

index=_internal source=*license* type=usage | stats sum(b) BY index

You can comment out portions of your search to help identify problems. Another option is to run the search in Verbose mode. In this search the stats portion of the search is commented out.

index=_internal source=*license* type=usage `comment("| stats sum(b) BY index")`

The results show the correct name for the field. You need to specify idx as the field name instead of index.

index=_internal source=*license* type=usage | stats sum(b) BY idx

(Thanks to Splunk user Runals for this example.)