Simple searches
There are two ways of searching information in the audit trail. If your query is simple, just type in the keywords of what you're looking for in the search field.
Example: all the drafts created in Dublin (see screenshot below)
Complex searches
If you want to specify the metadata/criteria, you can use complex searches. The table below shows the fields available to query using search. Field names are case sensitive.
Note: While field names are case sensitive, values of those fields are subject to full-text search processing, meaning (among other things) that you can search field values in case insensitive manner. E.g. to find documents in status “For approval” it’s enough to write query: status:approval
Field Name | Type | Description |
document.code | text | Example: "SOP-3" |
document.title | text |
|
document.status | text | Example: "Effective" |
user.id | text | Empty is user is "System" |
user.full_name | text |
|
user.email | text | Empty if user is "System" |
action | text | Example: "Sent for approval" |
target | text | Field containing what is displayed in the "target" column |
location.country | text | Country for given IP |
location.city | text | Approximate location for given IP |
date | numeric | YYYY-MM-DD format |
ip | numeric | Example: 185.345.0.2 |
Sample searches:
Goal | Search Query |
See all audit trail activities for the date April 25, 2023. | date:2023-04-25 |
See all failed sign-in attempts in the last 30 days | date:<now-30 action:"sign in failed" |
See all training completed by user "John Smith" | action:"training completed" user.full_name:john smith |
Events Closing Tracking:
To track events that were closed within a specific time frame, use the following search in the Audit Trail:
(action:”resolved event”) AND (date:>=YYYY-MM-DD) AND (date:<=YYYY-MM-DD)
Explanation:
(action:"resolved event")- This part of the search filters for events that have been resolved.(date:>=YYYY-MM-DD)- This filters for events with a closure date on or after the specified "YYYY-MM-DD" date.(date:<=YYYY-MM-DD)- This filters for events with a closure date on or before the specified "YYYY-MM-DD" date.
Remember:
Replace "YYYY-MM-DD" with the actual start and end dates for the time frame you want to track.
Ensure the dates are in the format "YYYY-MM-DD" (e.g., 2024-08-20).
Please note that this is a workaround, and direct tracking of events closing within a specific time frame is not currently a built-in feature.