How to get an alert whenever anyone updates test.c... - Splunk Community

Alerting

Whenever anyone updates test.csv Lookup table I want to get an alert.

Note: The update is done via Lookup editor and *Save Lookup* button is clicked.

Thanks for your response. I read in the documentation fschange was deprecated in the version 5 and I am using Splunk Enterprise version 8.1.5.

Can you please suggest an alternate solution?

I'd appreciate your help.

fschange is deprecated, but still works. I know of no alternative.

---
If this reply helps you, Karma would be appreciated.

I'd look into setting up an fschange input on the lookup file and define an alert to trigger when an event is received from the input.

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...