Splunk on Splunk - are there logs on Lookup csv file operations (add/delete)

[leonjxtan]

Issue statement:
I have a lookup csv file uploaded, with permission of read/write for a user group. Today the file disappeared!

Question:
Is there splunk log on Lookup csv file operations (add/delete)? If yes, where are they and I guess I can ask admin to make it searchable in Splunk.

Thanks.

[hardikJsheth]

It seems user was trying to override content of lookup file with a search but the search didn't return any rows and hence the file was lost. To find out the search, try to search for outputlookup command in your splunkd.log. You can use following search. Add the specific lookup file that you want to verify in the search.

index=_internal  "outputlookup"