topic Why is the map command a risky command? in Splunk Search

Why is the map command a risky command?

munang — Mon, 02 Sep 2024 11:22:15 GMT

Other than poor speed and performance, is there a reason why the map command is considered dangerous?

The official documentation says that the map command can result in data loss or potential security risks. But I don't see any details.

Why?

vigneshnarendra — Mon, 02 Sep 2024 12:10:45 GMT

HI @munang.

The risky command warning is only a safeguard for many commands which could be a potential risk if users run them without knowing what they are doing.

https://docs.splunk.com/Documentation/Splunk/9.3.0/Security/SPLsafeguards

You could set commands.conf as below and restart splunk to remove the warning.

[<your_command_name>]
is_risky = false

munang — Mon, 02 Sep 2024 12:56:41 GMT

So I'm curious about why maps are dangerous.

In some cases system data may be lost. I would like to know the detailed reason why it is possible.