Merge pull request #24 from sifters/sifters

Replace comment macro with triple backticks. 

Edits made to change single line `comment` to multiline ``` options in various locations.
Removed \" and changed to " as double quotes are not an issue with ```

Author: gjanders

default/data/ui/views/data_model_rebuild_monitor.xml

@@ -150,9 +150,9 @@
       </single>
       <single>
         <search>
-          <query>`comment("The authors original attempt of | `datamodel(\"Splunk_Audit\", \"Datamodel_Acceleration\")` | `drop_dm_object_name(\"Datamodel_Acceleration\")` Just did not appear to show accurate numbers when compared to the filesystem of the indexers")`
-`comment("The previous attempt at this number via | rest \"/services/admin/introspection--disk-objects--summaries?count=-1\" ... worked fine *unless* there were multiple search head GUID's in the introspection data in which case it seems to return 1 set only (resulting in highly inaccurate numbers in some cases")`
-    `comment("Now querying the introspection data instead as that provides consistently accurate numbers")`
+          <query>```The authors original attempt of | `datamodel("Splunk_Audit", "Datamodel_Acceleration | `drop_dm_object_name("Datamodel_Acceleration")` Just did not appear to show accurate numbers when compared to the filesystem of the indexers 
+The previous attempt at this number via | rest "/services/admin/introspection--disk-objects--summaries?count=-1" ... worked fine *unless* there were multiple search head GUID's in the introspection data in which case it seems to return 1 set only (resulting in highly inaccurate numbers in some cases)
+    Now querying the introspection data instead as that provides consistently accurate numbers```
     index=_introspection `indexerhosts` component=summaries "data.name"=*$dm$
 | stats latest(data.total_size) AS size by data.search_head_guid, data.related_indexes_count, data.related_indexes, host
 | stats sum(size) AS size</query>

default/data/ui/views/issues_per_sourcetype.xml

@@ -26,7 +26,7 @@
         <query>| rest "/servicesNS/-/$app$/directory" count=0 splunk_server=local
 | search eai:acl.app=$app$
 | rename eai:type AS type
-| search type!="macros" `comment("macros only appears in really new versions of Splunk via the directory endpoint, so assume it doesn't exist in this query")`
+| search type!="macros" ```macros only appears in really new versions of Splunk via the directory endpoint, so assume it doesn't exist in this query```
 | stats count by type
 | fields - count</query>
         <earliest>-24h@h</earliest>

default/data/ui/views/knowledge_objects_by_app.xml

@@ -101,7 +101,7 @@
       <title>CacheManager Queued download count</title>
       <chart>
         <search>
-          <query>`comment("Relates to [cachemanager] max_concurrent_downloads in server.conf. Thanks to Splunk support for the original version of this search")` index=_internal $host$ `splunkadmins_metrics_source` TERM(group=cachemgr_download) sourcetype=splunkd queued 
+          <query>```Relates to [cachemanager] max_concurrent_downloads in server.conf. Thanks to Splunk support for the original version of this search``` index=_internal $host$ `splunkadmins_metrics_source` TERM(group=cachemgr_download) sourcetype=splunkd queued 
 | timechart partial=f limit=50 avg(queued) AS avg_queued by host 
 | eval ceiling=20</query>
           <earliest>$time.earliest$</earliest>
@@ -136,7 +136,7 @@
       <title>Excessive cachemanager downloads</title>
       <chart>
         <search>
-          <query>`comment("Thanks to Splunk support for the original version of this search, similar version available in the monitoring console...")` index=_internal $host$ `splunkadmins_splunkd_source` sourcetype=splunkd CacheManager TERM(action=download) TERM(status=succeeded) TERM(download_set=*)
+          <query>```Thanks to Splunk support for the original version of this search, similar version available in the monitoring console...``` index=_internal $host$ `splunkadmins_splunkd_source` sourcetype=splunkd CacheManager TERM(action=download) TERM(status=succeeded) TERM(download_set=*)
 | rex field=cache_id "&gt;*\|(?&lt;index_name&gt;.*)~.*~.*\|" 
 | eval identifier=(cache_id + host) 
 | stats count by identifier, index_name 
@@ -159,7 +159,7 @@
       <title>CacheManager downloads by age/index</title>
       <chart>
         <search>
-          <query>`comment("Thanks to Splunk support for the original version of this search")` index=_audit $host$ TERM(action=remote_bucket_download) TERM(info=completed)
+          <query>```Thanks to Splunk support for the original version of this search``` index=_audit $host$ TERM(action=remote_bucket_download) TERM(info=completed)
 | eval gbps=kb/1024/1024 
 | eval age=round((now()-earliest_time)/60/60/24) 
 | bucket span=30 age 

default/data/ui/views/smartstore_stats.xml

@@ -80,7 +80,7 @@
       <title>Data output std deviation</title>
       <chart>
         <search>
-          <query>`comment("Credit to Brett Adams")` index=_internal $host$ sourcetype=splunkd `splunkadmins_metrics_source` component=Metrics TERM(group=tcpout_connections) name=$output_group$*
+          <query>```Credit to Brett Adams``` index=_internal $host$ sourcetype=splunkd `splunkadmins_metrics_source` component=Metrics TERM(group=tcpout_connections) name=$output_group$*
 | rex field=name "(?P&lt;destination&gt;[^:]+)"
 | search destination=$output_group$*
 | timechart span=1m sum(kb) by destIp limit=50