FAQ¶

How do I audit changes to the lookup files?¶

The lookup editor keeps a log that is indexed into the _internal index. You can view that logs like this:

index=_internal "Lookup edited successfully" | table _time user namespace lookup_file