topic How to display warning based on SPL? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-display-warning-based-on-SPL/m-p/596225#M207555 <P>Is there a way of showing a warning to the user based on their SPL.</P> <P>My use case is that users should not generally search indexes which are fed into an accelerated data model. Specifically it's faster and more accurate to search the network_traffic ADM than a firewall index.</P> Tue, 03 May 2022 16:03:21 GMT jonaclough 2022-05-03T16:03:21Z How to display warning based on SPL? https://community.splunk.com/t5/Splunk-Search/How-to-display-warning-based-on-SPL/m-p/596225#M207555 <P>Is there a way of showing a warning to the user based on their SPL.</P> <P>My use case is that users should not generally search indexes which are fed into an accelerated data model. Specifically it's faster and more accurate to search the network_traffic ADM than a firewall index.</P> Tue, 03 May 2022 16:03:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-warning-based-on-SPL/m-p/596225#M207555 jonaclough 2022-05-03T16:03:21Z Re: Display warning based on SPL https://community.splunk.com/t5/Splunk-Search/How-to-display-warning-based-on-SPL/m-p/596226#M207556 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/147711">@jonaclough</a>,</P><P>sorry: it isn't possible to define an automatic warning because it depends only on your specific data and it's also infruenced by other factors.</P><P>The only possible approach (for my knowledge) is the definition of a list of tips to use your data to share to all your users.</P><P>A kind of quick reference guide to use your own data.</P><P>Ciao.</P><P>Giuseppe</P> Tue, 03 May 2022 08:57:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-warning-based-on-SPL/m-p/596226#M207556 gcusello 2022-05-03T08:57:43Z Re: Display warning based on SPL https://community.splunk.com/t5/Splunk-Search/How-to-display-warning-based-on-SPL/m-p/596238#M207561 <P>If admission rules had an extra rule action option "issue warning" rather than just "filter search" that would do the job.&nbsp;</P> Tue, 03 May 2022 10:23:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-warning-based-on-SPL/m-p/596238#M207561 jonaclough 2022-05-03T10:23:12Z