Comment/Uncomment multiple lines

%3CLINGO-SUB%20id%3D%22lingo-sub-1346614%22%20slang%3D%22en-US%22%3EComment%2FUncomment%20multiple%20lines%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1346614%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EDo%20you%20know%20a%20way%20to%20comment%20and%20uncomment%20multiple%20lines%20in%20the%20Logs%20Blade%20in%20Azure%20Sentinel%20%3F%20I%20find%20it%20not%20convenient%20to%20type%20%22%2F%2F%22%20every%20time.%3CBR%20%2F%3EIs%20there%20a%20way%20to%20create%20a%20custom%20shortcut%20for%20it%20%3F%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EKind%20regards%2C%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EEmmanuel%20NGUYEN%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1346760%22%20slang%3D%22en-US%22%3ERe%3A%20Comment%2FUncomment%20multiple%20lines%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1346760%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F602895%22%20target%3D%22_blank%22%3E%40emmanuelnguyen%3C%2FA%3E%26nbsp%3BYou%20made%20me%20chuckle%20a%20little%20bit.%20Personally%2C%20I%20think%20its%20much%20easier%20to%20type%20two%20slashes%20(%2F%2F)%20than%20some%20of%20the%20other%20remarking%20operators%20for%20other%20query%20and%20scripting%20platforms.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHowever%2C%20you%20can%20use%20something%20like%20AutoHotkey%20(%3CA%20href%3D%22https%3A%2F%2Fwww.autohotkey.com%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.autohotkey.com%2F%3C%2FA%3E)%20to%20develop%20your%20own%20keyboard%20shortcuts%20that%20and%20assign%20the%20KQL%20commenting%20operator%20to%20a%20custom%20keystroke%20combination.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20think%20its%20awesome%20that%20you're%20commenting%2C%20though.%20Commenting%20in%20the%20queries%20is%20a%20perfect%20example%20of%20a%20best%20practice%20for%20developing%20queries%20that%20can%20be%20shared%20and%20redistributed%20with%20colleagues%20and%20teammates%2C%20but%20also%20available%20to%20quickly%20comprehend%20at%20a%20later%20date.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1346771%22%20slang%3D%22en-US%22%3ERe%3A%20Comment%2FUncomment%20multiple%20lines%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1346771%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F602895%22%20target%3D%22_blank%22%3E%40emmanuelnguyen%3C%2FA%3E%26nbsp%3BThere%20is%20currently%20no%20block%20comment%20in%20KQL.%26nbsp%3B%20%26nbsp%3BThe%20editor%20in%20Azure%20Sentinel%20has%20no%20macro%20or%20shortcut%20feature%20so%20you%20would%20need%20to%20enter%20the%20%22%2F%2F%22%20for%20each%20line.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWell%2C%20that%20is%20not%20entirely%20true.%26nbsp%3B%20There%20is%20a%20Command%20Palette%20that%20you%20can%20access%20by%20pressing%20F1%20and%20there%20is%20a%20%22Insert%20Line%20Comment%22%20that%20is%20supposed%20to%20work%20by%20pressing%20Ctrl-K%2C%20Ctrl-C%20but%20it%20does%20not%20appear%20to%20work%20(at%20least%20not%20in%20my%20environment)%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1350405%22%20slang%3D%22en-US%22%3ERe%3A%20Comment%2FUncomment%20multiple%20lines%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1350405%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324945%22%20target%3D%22_blank%22%3E%40rodtrent%3C%2FA%3E%26nbsp%3BI%20agree%20with%20you%2C%20that%20two%20slashes%20%22%2F%2F%22%20are%20a%20good%20and%20fast%20way%20to%20comment%20one%20line.%20But%20I%20think%20it's%20too%20bad%20that%20there%20aren't%20a%20way%20to%20comment%20a%20block%2Fmultiple%20lines%20with%20only%20one%20shortcut%2C%20rather%20than%20typing%20%22%2F%2F%22%20at%20each%20line.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EWhat%20is%20weird%20is%20that%20in%20the%20command%20palette%2C%20as%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3Bsaid%2C%20there%20is%20a%20command%20line%20for%20that%20%22Toggle%20Block%20Comment%22%20--%26gt%3B%20%22Shift%2BAlt%2BA%22%20but%20it's%20not%20working%20in%20my%20environment.%20And%20it%20seems%20that%20I'm%20not%20the%20only%20one.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EThank%20you%20for%20the%20recommendation%20about%20AutoHotkey%2C%20although%20I'm%20not%20certain%20that%20it%20will%20allow%20me%20to%20do%20this%20precise%20operation.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2371128%22%20slang%3D%22en-US%22%3ERe%3A%20Comment%2FUncomment%20multiple%20lines%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2371128%22%20slang%3D%22en-US%22%3E%3CP%3ENice%20post%2C%20thanks%3C%2FP%3E%3CP%3E%3CA%20title%3D%22Quran%20Para%202%20Sayaqool%20Para%22%20href%3D%22https%3A%2F%2Fwww.quranwazaif.com%2Fquran-para-2-sayaqool-recite-online-and-pdf%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EQuran%20Para%202%20Sayaqool%20Para%3C%2FA%3E%26nbsp%3B%3CA%20title%3D%22Quran%20Para%203%20Tilka%20Rasool%22%20href%3D%22https%3A%2F%2Fwww.quranwazaif.com%2Fquran-para-3-tilka-rasool-recite-online-pdf%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EQuran%20Para%203%20Tilka%20Rasool%3C%2FA%3E%26nbsp%3B%3CA%20title%3D%22Quran%20Para%204%20Lan%20Tanalu%22%20href%3D%22https%3A%2F%2Fwww.quranwazaif.com%2Fquran-para-4-lan-tanalu-4th-recite-online-pdf%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EQuran%20Para%204%20Lan%20Tanalu%3C%2FA%3E%26nbsp%3B%3CA%20title%3D%22Quran%20Para%205%20Wal%20Muhsanat%22%20href%3D%22https%3A%2F%2Fwww.quranwazaif.com%2Fquran-para-5-wal-muhsanat-5th-recite-online-pdf%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EQuran%20Para%205%20Wal%20Muhsanat%3C%2FA%3E%26nbsp%3B%3CA%20title%3D%22Quran%20Para%206%20La%20Yuhibbu%20Allah%22%20href%3D%22https%3A%2F%2Fwww.quranwazaif.com%2Fquran-para-6-la-yuhibbu-allah-6th-recite-online-pdf%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EQuran%20Para%206%20La%20Yuhibbu%20Allah%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi all, 

Do you know a way to comment and uncomment multiple lines in the Logs Blade in Azure Sentinel ? I find it not convenient to type "//" every time.
Is there a way to create a custom shortcut for it ? 

Kind regards, 

Emmanuel NGUYEN

3 Replies

@emmanuelnguyen You made me chuckle a little bit. Personally, I think its much easier to type two slashes (//) than some of the other remarking operators for other query and scripting platforms. 

 

However, you can use something like AutoHotkey (https://www.autohotkey.com/) to develop your own keyboard shortcuts that and assign the KQL commenting operator to a custom keystroke combination.

 

I think its awesome that you're commenting, though. Commenting in the queries is a perfect example of a best practice for developing queries that can be shared and redistributed with colleagues and teammates, but also available to quickly comprehend at a later date.

@emmanuelnguyen There is currently no block comment in KQL.   The editor in Azure Sentinel has no macro or shortcut feature so you would need to enter the "//" for each line.  

 

Well, that is not entirely true.  There is a Command Palette that you can access by pressing F1 and there is a "Insert Line Comment" that is supposed to work by pressing Ctrl-K, Ctrl-C but it does not appear to work (at least not in my environment)

@rodtrent I agree with you, that two slashes "//" are a good and fast way to comment one line. But I think it's too bad that there aren't a way to comment a block/multiple lines with only one shortcut, rather than typing "//" at each line. 

What is weird is that in the command palette, as @Gary Bushey said, there is a command line for that "Toggle Block Comment" --> "Shift+Alt+A" but it's not working in my environment. And it seems that I'm not the only one. 

Thank you for the recommendation about AutoHotkey, although I'm not certain that it will allow me to do this precise operation.