What is the reason for data missing in lookup table?

[Ash1]

Hi All, we have 4 env, sit1, sit2, pat1 and pat2,  We have lookup table from long time,  last 4 months back we have added some data into it, and we verified data was added .

but we are not sure when it got disappear, now we are not able to see that added data in the look up.

what could be the reason for missing? 

[burwell]

Could you check the modification date on the file? If it was recent you could possibly check the audit log for someone using SPL to overwrite it?

[richgalloway]

There are a few reasons for data to disappear from a lookup.

1) Someone restored an old backup/export.

2) Someone modified the lookup using the Lookup File Editor app or a CLI editor.

3) Someone ran a search that overwrote the lookup with old data.

There may be other explanations, but none I can think of would be Splunk's doing.