Splunk® Enterprise

Search Reference

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF


This command is experimental and not currently supported by Splunk.


Similar to the eval operator, calls the python expression for each result, calculating the outfield. Uses python to evaluate.


mappy <outfield> = <python expression>


Syntax: <field>
Description: Specify a field name to save the output of the Python expression.
python expression
Syntax: <python expression>
Description: An expression that uses a Python operation to calculate the result.


The mappy command, which stands for 'map Py(thon)', is used similar to the eval operator. The difference is that mappy uses the Python to evaluate the expression and calculate the output field.

It includes convenient packages for most common operations, such as re, sys, math, random, datetime, time, xml, lxml, StringIO, lxml.etree, platform, hashlib, difflib, base64, xml.sax.saxutils,etree. Does not allow Python expressions containing "open", "write", "read", or "import".


Example 1: Calculate math:

... | mappy score = int(_time) * random.randint(1,5)

Example 2: Similar to iconify:

... | mappy _icon = "hashlib.md5(_raw).hexdigest()"

Example 3: Data cleaning, make sure the value of the department field is one of the valid choices.

... | mappy department = "difflib.get_close_matches(department, ['engineering', 'marketing', 'sales'], cutoff=0)[0]"

Example 4: Anonymize email addresses.

... | mappy _raw = "re.sub('(?i)([a-z0-9.-]+@[a-z0-9.-]+)', 'user@company.com', _raw)"

Example 5: Xpath extractions.

... | mappy author = etree.parse(StringIO.StringIO(_raw)).xpath("//bookstore/boot/@author")'

See also

extract, iconify, reducepy, rex, xmlkv, xpath, xmlunescape


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the mappy command.


This documentation applies to the following versions of Splunk® Enterprise: 4.3

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters