FAQ¶

How do I audit changes to the lookup files?¶

The lookup editor keeps a log that is indexed into the _internal index. You can view that logs like this:

index=_internal "Lookup edited successfully" | table _time user namespace lookup_file

My lookup file cannot be opened, why not?¶

Look into the logs to see if there is a reason given why the files are not loading:

index=_internal source=*lookup_editor_controller.log