How to keep track lookups created via outputlookup?

[ericg57]

I was tasked with tracking the usage and cleanup of lookups for my envrionment and was wondering does splunk create an audit item or item within internal logs to track when a search produces a knowledge item such as a lookup to log the user who created the item plus the original search? Currently these lookups are owned by nobody and if the search was not saved then the search becomes lost if i cannot search through history to find any search that references the outputlookup command.

[isoutamo]

Hi

you could get the list of lookup files by 

| rest splunk_server=local /services/data/lookup-table-files/
| fields title author disabled eai:acl.app eai:acl.owner eai:acl.sharing eai:appName eai:data

I suppose that you can also search from _audit events where outputlookup command has used like

index=_audit
| regex search="outputlookup"
| table search

 With these you could get at least some idea what you have and when those are created and by whom. Also you could use _audit log to see if those are used  or not.

r. Ismo