Getting Data In

How to audit logs for lookup file changes/modifications using lookup editor?

james_n
Path Finder

Hi,

I'm trying to identify the users who updated which look file and what information they updated. I was planning to track such information using dashboards. Thank you for your assistance in advance.

The one I tested is below since it only displays a limited collection of data such as user, app, and lookup file name.

index=_internal "Lookup edited successfully" | table _time user namespace lookup_file

 

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...