Knowledge Management

Splunk on Splunk - are there logs on Lookup csv file operations (add/delete)

leonjxtan
Path Finder

Issue statement:
I have a lookup csv file uploaded, with permission of read/write for a user group. Today the file disappeared!

Question:
Is there splunk log on Lookup csv file operations (add/delete)? If yes, where are they and I guess I can ask admin to make it searchable in Splunk.

Thanks.

0 Karma

hardikJsheth
Motivator

It seems user was trying to override content of lookup file with a search but the search didn't return any rows and hence the file was lost. To find out the search, try to search for outputlookup command in your splunkd.log. You can use following search. Add the specific lookup file that you want to verify in the search.

index=_internal  "outputlookup"
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...