Someone accidentally deleted a dataset - a lookup from the app's Datasets section. Is there a way to recover it? It's on a standalone search head.
if you have a backup or splunk diag, go to your last backup or diag.
if not, well, its gone
View solution in original post
And we can trace the deletion via index=_audit <id> action=deleted.
index=_audit <id> action=deleted