Dashboards & Visualizations

How to know who added a new line in my lookup ?

mah
Builder

Hi,

Is it possible to know which user create/write a line in my lookup by doing a search with  outputlookup command like ::

index=A

| table id name

| outputlookup my_lookup.csv

 

Thanks for your help !

0 Karma
1 Solution

jacobpevans
Motivator

Greetings @mah,

Give the search below a try:

index=_audit sourcetype=audittrail "outputlookup" "my_lookup.csv"
| table _time action user info search
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

jacobpevans
Motivator

Greetings @mah,

Give the search below a try:

index=_audit sourcetype=audittrail "outputlookup" "my_lookup.csv"
| table _time action user info search
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

mah
Builder

hi @jacobpevans 

This do the job !

Thanks !

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...