Knowledge Management

Splunk on Splunk - are there logs on Lookup csv file operations (add/delete)

leonjxtan
Path Finder

Issue statement:
I have a lookup csv file uploaded, with permission of read/write for a user group. Today the file disappeared!

Question:
Is there splunk log on Lookup csv file operations (add/delete)? If yes, where are they and I guess I can ask admin to make it searchable in Splunk.

Thanks.

0 Karma

hardikJsheth
Motivator

It seems user was trying to override content of lookup file with a search but the search didn't return any rows and hence the file was lost. To find out the search, try to search for outputlookup command in your splunkd.log. You can use following search. Add the specific lookup file that you want to verify in the search.

index=_internal  "outputlookup"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...