Warning User when try to execute outoutlook up command from front end to avoid deleteing accidental records from kvstore

[vksplunk1]

Hi  -  Is there a way to Warning the user when try to execute outoutlook up command from front end to avoid deleting accidental records from kvstore.

Thank you

[livehybrid]

Hi @vksplunk1 

Outputlookup is already categorised as a risky command in terms of protection against SPL in links clicked, or in dashboard ("In the Search app, the warning dialog box appears when you click a link or type a URL that loads a search which contains risky commands. In dashboards, the warning dialog box appears automatically unless an input or visualization contains a search with a risky command") however it is not currently possible to display the alert if a user just types it out themselves into the search bar.
Check out https://docs.splunk.com/Documentation/Splunk/9.4.0/Security/SPLsafeguards for more information about this.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will