Splunk search for Ingested Comments
Copy
[ | tstats count where punct=#* by index, sourcetype | fields - count | format ] _raw=#*
This search will return comments that have been ingested into Splunk. This search assumes that any event that begins with # is a comment.
0 comments
[0]
[0]
[0]
[0]
Sign in or Register to submit a comment