Querying and filtering audit logs

  • 3 minute(s) read
Prev Next

Use filters to query audit logs and locate specific events.

The available filters differ when viewing audit logs for the entire realm, and viewing those for a specific app:

Filter name

Input

Location

Start and end date

Enter a date range from one to seven days, inclusive

Realm and App

Table

Enter a table name, or leave blank to search all tables

App only

App name

Enter an app name, or leave blank to search all apps

Deleted apps cannot be queried

Realm only

User email

Enter a user email, or leave blank to search logs for all users

Realm and App

Actions

Enter one or more actions separated by commas, or leave blank to search all actions

Realm and App

Resource type

Select a resource type:

  • Record

  • Report

  • Field (shows logs for fields used in Quickbase apps)

  • API field usage (shows logs for fields used by APIs, learn more)

  • Form

App only

Resource ID

Enter the ID of a resource

You must also select the resource type

App only

Log ID

Enter a log ID to search all audit logs within the retention period purchased

Realm and App

Query audit logs

To query audit logs using a filter:

  1. Access audit logs.

  2. Select a filter at the top of the page. Depending on which filter you choose, enter the appropriate information. You can use either the Log ID as a single filter, or any combination of the other available filters.
    Note: If you don't specify any filters, all activity within the specified date range displays.

  3. Click Display logs to apply the chosen filter(s). You can repeat the steps to change and/or combine filters to alter your results.

Note

  • It may take up to 5 minutes to see a new audit log event appear.

  • Audit metadata, such as usernames and emails, is updated once per day. As a result, there may be up to a 24-hour gap before new events reflect updated metadata, including for new users. However, when exporting events from the admin console, the user ID is included, allowing you to associate events with specific users, even before the metadata is updated.

Information included in audit logs

Audit logs display the following information:

Item

Description

Log ID 

Auto-generated identifier of the audit log.

First Name

User’s first name.

Last Name

User’s last name.

Email Address

User’s email address.

Action

What action was taken, such as log in, create app, report access, or table search.

Browser time

Exact time the action was taken, including date, and time with hour, minutes and seconds. Time zone is the browser time zone.

IP

The IP address the action was taken from.

User Agent

The browser and OS the action was taken from.

Session Information

The Session ID associated with a user’s browsing session on a particular device (which resets when the session expires), or a short snippet of the User Token, which is used for compatible API calls.

You can use this information to trace back the user who performed a particular action when using a service account or through an API. For example, an audit log for an action performed by a service account will only contain the service account used in the description. You can trace the Session ID back to the user session associated with the service account by locating the service_account_impersonate event, which indicates when a user switched to using a service account.

Description

A description of the action that occurred. Some audit logs contain links to the resource that was accessed or changed, or links to view additional details.

View examples of descriptions in the Audit Log Library.

Application*

UI for user interface or API for an API call.

Resource URL*

Link to the resource in Quickbase that was accessed or changed.

User ID*

Unique identifier of the user who performed the action.

Realm ID*

The realm the action was performed in.

Payload Changes*

Payload containing information about the changes made to the resource.

*Only available in the CSV download

APIs included in the API field usage filter

The API field usage resource type filter returns API usage of particular fields, so you can identify if a field is being used in API calls and integrations. This table shows which APIs are included in this filter: