Hi,
I'm trying to identify the users who updated which look file and what information they updated. I was planning to track such information using dashboards. Thank you for your assistance in advance.
The one I tested is below since it only displays a limited collection of data such as user, app, and lookup file name.
index=_internal "Lookup edited successfully" | table _time user namespace lookup_file
