Actions in the warning dialog box

Instead of running the search immediately, the Splunk platform analyzes the search or dashboard for risky commands. If the platform identifies one or more risky commands in a search, a warning dialog box appears. If the platform identifies one or more risky commands in a dashboard, the warning appears automatically, or you must click the error icon to invoke the dialog box.

Search

With the Search warning dialog box, you have the option to cancel, run, or investigate the search.

Cancel

Closes the warning dialog box. The search does not run and Splunk Web removes the search from the Search bar. If you close the dialog box by clicking the Close button (X), it is the same action as clicking Cancel.

Run

Runs the search. The Splunk platform runs any risky commands in the search because you authorized it. You can't undo this action.

Investigate

Displays the search in the Search bar so that you can review the SPL. Use this option to copy the syntax of the search. Send a copy of the search, along with any information about the source of the link, to your system administrator.

Dashboards

The Dashboards warning dialog box prompts you to accept or reject the risk of running the query with the risky command. The workflow of the dialog box depends on what dashboard component connects to the search that triggers the safeguard.

  • Inputs and visualizations with risky commands do not run automatically. You must click the error icon to invoke the warning modal to run the search.
  • Risky searches that are not associated with inputs or visualizations will automatically display the warning dialog box.

With the Dashboards warning dialog box, you have the option to cancel or run the search.

Cancel

Closes the warning dialog box. The search does not run.

Run Query Anyway

Runs the search. The Splunk platform runs any risky commands in the search because you authorized it. You can't undo this action.

Risky chained searches

If the Splunk platform identifies a risky command within a chained search, you must resolve each chained search that extends the risky command, even if only one of the searches within the chain contains a risk.

For example, a chain search has a safe base search, but one risky search out of two:

base search + risky chain search 1 + chain search 2

Although only risky chain search 1 poses a risk, chain search 2 also triggers a warning dialog box because it extends the risk of risky chain search 1. In this scenario, you can safely run chain search 2 to reach the warning dialog box for risky chain search 1 and decide to run or cancel risky chain search 1.

For more details about chained searches, see Create a chain search.