Lookup CSV updates for a audit purpose?

[joomla]

Hi Team,

Can we monitor the lookup files i.e from updates prospective who updates what in a lookup file or even in a KV store. This is one of the requirements of monitoring so that if tomorrow something needed; we can backtrack and able to answer who; what and when.

Thanks in advance.

[ITWhisperer]

I don't think this is tracked by Splunk - How are you updating the csv store? If you are using a search, you could update the csv to include a field with the user who updated it, or you could restrict the update process so that only certain users could perform the update.