https://community.splunk.com/t5/Getting-Data-In/How-to-audit-logs-for-lookup-file-changes-modifications-using/m-p/614149#M106292 <P>Hi,<BR /><BR />I'm trying to identify the users who updated which look file and what information they updated. I was planning to track such information using dashboards. Thank you for your assistance in advance.<BR /><BR />The one I tested is below since it only displays a limited collection of data such as user, app, and lookup file name.</P> <PRE>index=_internal "Lookup edited successfully" | table _time user namespace lookup_file</PRE> <P>&nbsp;</P> Thu, 22 Sep 2022 16:10:48 GMT james_n 2022-09-22T16:10:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-audit-logs-for-lookup-file-changes-modifications-using/m-p/614149#M106292 <P>Hi,<BR /><BR />I'm trying to identify the users who updated which look file and what information they updated. I was planning to track such information using dashboards. Thank you for your assistance in advance.<BR /><BR />The one I tested is below since it only displays a limited collection of data such as user, app, and lookup file name.</P> <PRE>index=_internal "Lookup edited successfully" | table _time user namespace lookup_file</PRE> <P>&nbsp;</P> Thu, 22 Sep 2022 16:10:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-audit-logs-for-lookup-file-changes-modifications-using/m-p/614149#M106292 james_n 2022-09-22T16:10:48Z