- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why is the map command a risky command?
Other than poor speed and performance, is there a reason why the map command is considered dangerous?
The official documentation says that the map command can result in data loss or potential security risks. But I don't see any details.
Why?
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Map
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hello. @vigneshnarendra
So I'm curious about why maps are dangerous.
In some cases system data may be lost. I would like to know the detailed reason why it is possible.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI @munang.
The risky command warning is only a safeguard for many commands which could be a potential risk if users run them without knowing what they are doing.
https://docs.splunk.com/Documentation/Splunk/9.3.0/Security/SPLsafeguards
You could set commands.conf as below and restart splunk to remove the warning.
[<your_command_name>] is_risky = false
