https://community.splunk.com/t5/Monitoring-Splunk/Lookup-CSV-updates-for-a-audit-purpose/m-p/608801#M9072 <P>I don't think this is tracked by Splunk - How are you updating the csv store? If you are using a search, you could update the csv to include a field with the user who updated it, or you could restrict the update process so that only certain users could perform the update.</P> Tue, 09 Aug 2022 07:49:45 GMT ITWhisperer 2022-08-09T07:49:45Z https://community.splunk.com/t5/Monitoring-Splunk/Lookup-CSV-updates-for-a-audit-purpose/m-p/608798#M9071 <P>Hi Team,</P> <P>Can we monitor the lookup files i.e from updates prospective who updates what in a lookup file or even in a KV store. This is one of the requirements of monitoring so that if tomorrow something needed; we can backtrack and able to answer who; what and when.</P> <P>Thanks in advance.</P> Tue, 09 Aug 2022 15:04:06 GMT https://community.splunk.com/t5/Monitoring-Splunk/Lookup-CSV-updates-for-a-audit-purpose/m-p/608798#M9071 joomla 2022-08-09T15:04:06Z https://community.splunk.com/t5/Monitoring-Splunk/Lookup-CSV-updates-for-a-audit-purpose/m-p/608801#M9072 <P>I don't think this is tracked by Splunk - How are you updating the csv store? If you are using a search, you could update the csv to include a field with the user who updated it, or you could restrict the update process so that only certain users could perform the update.</P> Tue, 09 Aug 2022 07:49:45 GMT https://community.splunk.com/t5/Monitoring-Splunk/Lookup-CSV-updates-for-a-audit-purpose/m-p/608801#M9072 ITWhisperer 2022-08-09T07:49:45Z