Splunk Search

Flagged Risky Commands- Why is Splunk no longer recognizing command?

Path Finder

We have this dashboard that recently started alerting us on a risky command. We were using the fit command. 



I followed the docs and added the following line to the newly created commands.conf that i had put in the apps local folder to push. 

is_risky = false

According to the docs, i assumed that this would just disable the warning for using that command. After i put it into the specified apps local folder, /export/opt/splunk/etc/shcluster/apps/<app-name>/local, I pushed the bundle and it seemed to have put it in the apps default folder on the search heads. But the biggest issue here is that once i pushed that bundle, splunk doesn't recognize the fit.py file any more. I tested putting that commands.conf in the apps default folder, same thing. I tested this a few times, and while im glad that the bundle pushes were working, im a bit confused as to why splunk no longer recognizes that command even though im only using the is_risky=false, which should only stop the warning. 


Any help on this matter would be appreciated. Thank you. And if you could also answer as to why the local file in the app's directory is pushing to the apps default folder on the search heads, that would be a bonus. Thank you. 

Labels (1)
Tags (2)
0 Karma


If you add the stanza [fit] is_risky=false to /opt/splunk/etc/shcluster/apps/Splunk_ML_Toolkit/local/commands.conf on the SHC deployer, then apply the bundle to the SHC members, it seems to have resolved the problem of Splunk not finding fit.py.

0 Karma


Had a similar issue. After adding "[fit] is_risky = false" to commands.conf, Splunk complained that it could not find fit.py when executing the fit command from within my app.  However, it could find fit.py if I ran the fit command within the MLTK app.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...