How to know who added a new line in my lookup ?

[mah]

Hi,

Is it possible to know which user create/write a line in my lookup by doing a search with  outputlookup command like ::

index=A

| table id name

| outputlookup my_lookup.csv

Thanks for your help !

[jacobpevans · Accepted solution]

Greetings @mah,

Give the search below a try:

index=_audit sourcetype=audittrail "outputlookup" "my_lookup.csv"
| table _time action user info search

[mah]

hi @jacobpevans 

This do the job !

Thanks !