https://community.splunk.com/t5/All-Apps-and-Add-ons/Update-Log-Lookup-File-Editor/m-p/464587#M57095 <P>Hi,<BR /> I am working with the app lookup File Editor and When I search in the log, I only find the following<BR /> Who update the file ? or When update the file?</P> <P>I need to see which field to update.<BR /> It is possible?</P> <P>Regards </P> Tue, 27 Aug 2019 18:29:52 GMT Carolina 2019-08-27T18:29:52Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Update-Log-Lookup-File-Editor/m-p/464587#M57095 <P>Hi,<BR /> I am working with the app lookup File Editor and When I search in the log, I only find the following<BR /> Who update the file ? or When update the file?</P> <P>I need to see which field to update.<BR /> It is possible?</P> <P>Regards </P> Tue, 27 Aug 2019 18:29:52 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Update-Log-Lookup-File-Editor/m-p/464587#M57095 Carolina 2019-08-27T18:29:52Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Update-Log-Lookup-File-Editor/m-p/464588#M57096 <P>I don't believe Splunk audit logs will audit the changes to that level. </P> <P>The only way I can think of determining the details would be to compare the lookup file contents by comparing the backup versions. </P> <P>A log entry should show that a backup was created. You could correlate the backup file version to the change (search for "A backup of the lookup file was created"). However, I'm don't know of a way to access the backup lookup file via a Search. </P> Tue, 27 Aug 2019 20:18:54 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Update-Log-Lookup-File-Editor/m-p/464588#M57096 solarboyz1 2019-08-27T20:18:54Z