Common System Log filters

You can filter events by various parameters and operators in the System Log. By default, the filters display all events for the last seven days.

Recently unassigned users

Identify users that were recently unassigned from an application.

Filter Query

All unassignment events

eventType eq "application.user_membership.remove"

Filter by user login (username)

eventType eq "application.user_membership.remove" AND target.alternateId eq "someuser@foo.bar"

Filter by display name

eventType eq "application.user_membership.remove" AND target.displayName eq "some user"

Filter by application instance name

eventType eq "application.user_membership.remove" AND (target.alternateId eq "Application name" or target.displayName eq "Application Name")

Filter by application id

eventType eq "application.user_membership.remove" and target.id eq "0oaSomeValue"

Deprovision details

Identify the applications a user has been deprovisioned from and how the deprovision was initiated over a specified period of time.

Filter Query

Filter by user login (username)

 eventType eq "application.provision.user.deprovision" AND target.alternateId eq "someuser@foo.bar"

Filter by user display name

 eventType eq "application.provision.user.deprovision" and target.displayName eq "some name"

Filter by application instance name

 eventType eq "application.provision.user.deprovision" AND (target.alternateId eq "Application name" or target.displayName eq "Application Name")

Filter by application id

 eventType eq "application.provision.user.deprovision" and target.id eq "0oaSomeValue"

Filter by application username

eventType eq "application.provision.user.deprovision" AND target.alternateId eq "someuser@foo.bar"

Filter by resolution: auto deprovisioned

eventType eq "application.provision.user.deprovision" and target.detailEntry.resolution eq "Auto Deprovisioned"

Filter by resolution: manually deprovisioned

eventType eq "application.provision.user.deprovision" and target.detailEntry.resolution eq "Manually Deprovisioned"

Filter by user and application

eventType eq "application.provision.user.deprovision" and target.alternateId eq "someuser@foo.bar" and target.displayName eq "Application Name"