Best Practice: Adding comments in query syntax

Adding comments to your syntax is a great way to facilitate knowledge transfer and make query triage much easier. To add comments to a query in-line, type two forward slashes in the LogScale query editor. The comment will be highlighted in green. You can add as many comments as you'd like- here is a quick example:

// Get all ProcessRollup2 events
// Search for system User SID
| UserSid="S-1-5-18"
// Count total executions
| count(aid, as=totalExecutions)

The above code block will result in:

Visual example of adding comments to a LogScale query