Hi All, we have 4 env, sit1, sit2, pat1 and pat2, We have lookup table from long time, last 4 months back we have added some data into it, and we verified data was added .but we are not sure when it got disappear, now we are not able to see that added data in the look up.
what could be the reason for missing?
Could you check the modification date on the file? If it was recent you could possibly check the audit log for someone using SPL to overwrite it?
There are a few reasons for data to disappear from a lookup.
1) Someone restored an old backup/export.
2) Someone modified the lookup using the Lookup File Editor app or a CLI editor.
3) Someone ran a search that overwrote the lookup with old data.
There may be other explanations, but none I can think of would be Splunk's doing.