Splunk searches can often become many lines long and employ many SPL dark arts to wrangle the data set into a consumable report or dashboard.

As of Splunk 8.1 three backticks can be added to signify comments in your SPL code. The backticks should be added before and after the comment.

Do your future self (or colleague) a favour and explain what you are doing in your SPL searches, a few seconds of effort now could save many minutes or hours in the future!

Comments in SPL code

SPL comments and other methods for achieving readable SPL are documented in the Search Manual:
https://docs.splunk.com/Documentation/Splunk/8.1.2/Search/Parsingsearches

For 2021 we’ve committed to posting a new Splunk tip every week!

If you want to keep up to date on tips like the one above then sign up below:

Subscribe to our newsletter to receive regular updates from iDelta, including news and updates, information on upcoming events, and Splunk tips and tricks from our team of experts. You can also find us on Twitter and LinkedIn.

Subscribe

* indicates required
Posted by:Stuart Robertson

Stuart Robertson is the Consulting Director at iDelta. He is one of the initial founders of iDelta and has worked there since formation in 2001. Stuart holds various certifications in Core Splunk and ITSI. Stuart also holds a Bsc(Hons) in Computing Science from the University of Glasgow.

One thought on “Comments in SPL – new in Splunk 8.1”

  1. Pingback: Splunk Keyboard Shortcuts - iDelta

Comments are closed.