topic Re: Is mappy here to stay? in Splunk Search

Is mappy here to stay?

rshoward — Wed, 13 Apr 2011 04:35:36 GMT

I cannot lie, I love mappy. Especially for debugging/testing simple custom commands. Has there been any decision on whether this will be a command we will see more of in the future? If not, maybe keep it and other commands like it as a disabled-by-default APP...

Also, if this command goes away in a future release, is there any code license violations if I were to keep a backup of it and keep using it? (understanding it may not be supported of course).

Re: Is mappy here to stay?

carasso — Thu, 14 Apr 2011 10:57:45 GMT

I'm glad you find mappy useful. It's currently undocumented, as it's marked as experimental. I'd like to tighten up the security on it, for example. How did you find out about it? Have you played with reducepy?

I couldn't imagine there being any problem with you using it with Splunk, were we to remove the feature. We're nice people, and if you're using it with Splunk, what's not to like.

Re: Is mappy here to stay?

rshoward — Thu, 14 Apr 2011 23:29:39 GMT

I have not used reducepy yet. I was pointed at mappy by an SE while looking for a way to make my own eval functions. I ended up with http://answers.splunk.com/questions/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-associate/13701#13701 but ended up completely blowing my whole weekend playing around with mappy as well. When you have a ton of analysts all wanting to get their mitts on their own custom commands, mappy is a godsend. They can most of their own testing and tweaking.

I'll take a look at reducepy now. 🙂 Thanks again!

Re: Is mappy here to stay?

Paolo_Prigione — Wed, 14 Dec 2011 10:42:32 GMT

Mappy has disappeared from the latest 4.3Beta (out Dec 13th, build 114250). It was in $SPLUNK_HOME/etc/apps/search/bin/mappy.py in the september beta, and is present in the beta docs.