I have found a slight workaround. When "Delete" is clicked in "The Lookup Updater" a webcall is made that performs a search. The search looks like this:
search:| inputlookup test.csv| eval zomgItsOurRow=if(GroupName=="Test_Group","1","0")| streamstats count(eval(zomgItsOurRow==1)) as zomgHaveWeMatchedYet| eval zomgItsOurRow=if(zomgHaveWeMatchedYet<2,zomgItsOurRow,0)| fields - zomgHaveWeMatchedYet| search NOT zomgItsOurRow=1 | fields - zomgItsOurRow | outputlookup test.csv
I then simply looked at index=_audit for this search being performed. It includes the user, time, and entry that they removed.
... View more