Splunk® Enterprise

Search Manual

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Use comments to troubleshoot a search

You can use the inline commenting feature to troubleshoot a search.

The following search example is attempting to return the bytes for the individual indexes. However, the search has the wrong field in the stats command <split-by clause>.

index=_internal source=*license* type=usage | stats sum(b) BY index

You can comment out portions of your search to help identify problems. In this search the stats portion of the search is commented out.

index=_internal source=*license* type=usage ```| stats sum(b) BY index```

The results show the correct name for the field. You need to specify idx as the field name instead of index.

index=_internal source=*license* type=usage | stats sum(b) BY idx

(Thanks to Splunk user Runals for this example.)

For more information about adding inline comments to your searches, see Help reading searches.

Last modified on 26 June, 2020
What's in this section?
Calculate sizes of dynamic fields

This documentation applies to the following versions of Splunk® Enterprise: 8.1.0, 8.1.1, 8.1.2, 8.1.3

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters