Skip to main content
Version: 6.1

Adding comments

Use Cases​

Comments can be used for a variety of purposes, such as describing query logic, functions, and arguments, as well as debugging and temporarily excluding sections of code. They help improve understanding of queries and make them easier to support in the future.

Comment Syntax​

In the SML query language, comments are enclosed between the characters /* and */.

Example:

Comment formatting example
source winlog_auth
/*Comments*/
| search event.code="4678"

Special symbols​

Special Unicode characters may be used in comments; escape characters, single and double backquotes are also ignored.

Comment formatting example
source sm_cs_auth_index
/*Comment ƱĠŔ*/

Using Comments to Troubleshoot​

Comments in SML play an important role in debugging queries and finding errors.

  • Excluding code for testing. If you want to test a query without a certain part of the code, you can comment out that part. This allows you to test individual sections of the query and identify problems
  • Description of changes. When making changes to queries, especially if they relate to solving specific problems, it is recommended to add comments describing the essence of the changes made. This will help you and your team track and understand changes more easily
  • Bug tracking. Adding comments describing errors or suspected causes will help you and your colleagues quickly find and fix problems when working with queries
Example of excluding part of the code to test a query
source sm_cs_auth_index
| table destination.address, destination.ip, source.ip, event.action
/* | eval event.log.out=if(like(event.action, "%logged%"), "Entrance/Exit", "Kerberos") */
| rename destination.address as "Target server address", destination.ip as "Target server IP", source.ip as "Source IP", event.action as "Event", event.log.out as "Result"