Event Search
There are two modes of searching an event, Basic and Advanced.
Basic Search
Events can be searched by providing required parameters inside filter menu on top of Audit Trail page. The search results returned are from all the entities, which is across all workspaces, all types of operations and so on.
In a basic search, following are the options by which you can perform a search.
Time Range search
Time Duration search.
Full Text Search
Keyword Search
Note: Time Range and Time Duration search is also performed in Advanced Search.
Different filter operations are available which are listed below.
Time Range Search
Provide time intervals by setting Start Date Time and End Date Time filters to get those event interactions which were performed in specified time range.
Default value is 12 hours ago from the current system time.
Click on Set button for it to reflect the selected date time.
Duration Based Search
Select Duration option for defining time intervals. Provide duration as integer value with desired time unit. Default duration value is 12 and unit is hours.
Possible units are minutes, hours, days and weeks.
Full Text Search
To search events based on keyword or pattern, use Full text search filter option.
Use wildcard (*) to create pattern or provide exact value. System will search events by matching all field values of record.
Keyword Search
To perform search on any of the field value of the event record, use colon based pattern.
For example- interactionBy:John*, where, interactionBy is one of the field name of event record which specifies the user name who performed that event and John* is value of field interactionBy.
Possible field names which can be used to perform Keyword search are as follows:
| Field Name | Description |
|---|---|
| timestamp | Epoch time, in milliseconds, when the event was performed, e.g., 1560369000 |
| entityType | Entity type on which action was performed, e.g., pipeline, user, work-space, inspect_session, etc. |
| entityName | Name of the entity on which event was performed, e.g., pipeline name, workflow name, user name etc. |
| operation-Name | The type of action performed on entity, e.g., create, up-date, delete, list, access, share, revoke, etc. |
| description | Descriptive message about the event interaction. |
| interactionBy | User who caused the interaction event. |
| tenantId | The tenant id in which event occurred. |
| tenantName | The tenant name associated with tenant id. |
Advanced Search
In contrast to basic Full Text Search, you can perform advance search where you need to select list of entities and operations on which you want to search event interactions.
Possible entities and operation types will be listed on Entity and Operation drop down filters respectively.
Filter out event interactions based on workspace names. The event occurred in specified work-space will be shown. This filter operation is visible in superuser workspace only.
If you have any feedback on Gathr documentation, please email us!