Hi,
Is it possible to know which user create/write a line in my lookup by doing a search with outputlookup command like ::
index=A
| table id name
| outputlookup my_lookup.csv
Thanks for your help !
Greetings @mah,
Give the search below a try:
index=_audit sourcetype=audittrail "outputlookup" "my_lookup.csv"
| table _time action user info search
Greetings @mah,
Give the search below a try:
index=_audit sourcetype=audittrail "outputlookup" "my_lookup.csv"
| table _time action user info search