Splunk searches can often become many lines long and employ many SPL dark arts to wrangle the data set into a consumable report or dashboard.
As of Splunk 8.1 three backticks can be added to signify comments in your SPL code. The backticks should be added before and after the comment.
Do your future self (or colleague) a favour and explain what you are doing in your SPL searches, a few seconds of effort now could save many minutes or hours in the future!
For 2021 we’ve committed to posting a new Splunk tip every week!
If you want to keep up to date on tips like the one above then sign up below:
Subscribe to our newsletter to receive regular updates from iDelta, including news and updates, information on upcoming events, and Splunk tips and tricks from our team of experts. You can also find us on Twitter and LinkedIn.