Is mappy here to stay?

[rshoward]

I cannot lie, I love mappy. Especially for debugging/testing simple custom commands. Has there been any decision on whether this will be a command we will see more of in the future? If not, maybe keep it and other commands like it as a disabled-by-default APP...

Also, if this command goes away in a future release, is there any code license violations if I were to keep a backup of it and keep using it? (understanding it may not be supported of course).

[carasso · Accepted solution]

I'm glad you find mappy useful. It's currently undocumented, as it's marked as experimental. I'd like to tighten up the security on it, for example. How did you find out about it? Have you played with reducepy?

I couldn't imagine there being any problem with you using it with Splunk, were we to remove the feature. We're nice people, and if you're using it with Splunk, what's not to like.

[Paolo_Prigione]

Mappy has disappeared from the latest 4.3Beta (out Dec 13th, build 114250). It was in $SPLUNK_HOME/etc/apps/search/bin/mappy.py in the september beta, and is present in the beta docs.

[rshoward]

I have not used reducepy yet. I was pointed at mappy by an SE while looking for a way to make my own eval functions. I ended up with http://answers.splunk.com/questions/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-... but ended up completely blowing my whole weekend playing around with mappy as well. When you have a ton of analysts all wanting to get their mitts on their own custom commands, mappy is a godsend. They can most of their own testing and tweaking.

I'll take a look at reducepy now. 🙂 Thanks again!