RayM1 Trusted Contributor.
Trusted Contributor.
806 views

HPE RM: Searching Active Audit Events

Jump to solution

Hi All,

I'm looking at constructing a search string to search the "Active Audit Events" for specific events associated with a user over a specific time period, for example, which records did user "RAYM1" View,  Check In, Check Out between two dates, last week, last month etc.

Any help will be gratefully received.

Ray

Tags (1)
0 Likes
1 Solution

Accepted Solutions
Highlighted
Outstanding Contributor.. Steve Macukat Outstanding Contributor..
Outstanding Contributor..

Re: HPE RM: Searching Active Audit Events

Jump to solution

This should display the records a user has checked-in or out;

audit:[user:[name:"lastname, firstname"] and date:15/05/2017 to 22/05/2017 and type:DocumentCheckedOut,"DocumentCheckedIn(Replace)","DocumentCheckedIn(NewRevision)","DocumentCheckedIn(UndoCheckout)"]

Edit "lastname, firstname" and set the dates to the value you want.

You could also try the search using the values "me" and "this week" etc.

audit:[user:[default:me] and date:"This Week" and type:DocumentCheckedOut,"DocumentCheckedIn(Replace)","DocumentCheckedIn(NewRevision)","DocumentCheckedIn(UndoCheckout)"]

Afterwards you can change to the Boolean editor to see how its constructed visually.  I tend to move back & forth between the two to refine a complex string search & iron out the bugs.

 BTW sorry about all the edits.

0 Likes
4 Replies
DarrenBenney Respected Contributor.
Respected Contributor.

Re: HPE RM: Searching Active Audit Events

Jump to solution

Hi there,

I have been asked to do this in the past. 

What I did was perform an Online Audit Log search refined to the user ID and date range, then when the results were returned > tag all > right click > copy and paste into a spreadsheet, then sort/filter the results.

Hope it helps.

Regards,

 

Darren 

0 Likes
Highlighted
Outstanding Contributor.. Steve Macukat Outstanding Contributor..
Outstanding Contributor..

Re: HPE RM: Searching Active Audit Events

Jump to solution

This should display the records a user has checked-in or out;

audit:[user:[name:"lastname, firstname"] and date:15/05/2017 to 22/05/2017 and type:DocumentCheckedOut,"DocumentCheckedIn(Replace)","DocumentCheckedIn(NewRevision)","DocumentCheckedIn(UndoCheckout)"]

Edit "lastname, firstname" and set the dates to the value you want.

You could also try the search using the values "me" and "this week" etc.

audit:[user:[default:me] and date:"This Week" and type:DocumentCheckedOut,"DocumentCheckedIn(Replace)","DocumentCheckedIn(NewRevision)","DocumentCheckedIn(UndoCheckout)"]

Afterwards you can change to the Boolean editor to see how its constructed visually.  I tend to move back & forth between the two to refine a complex string search & iron out the bugs.

 BTW sorry about all the edits.

0 Likes
RayM1 Trusted Contributor.
Trusted Contributor.

Re: HPE RM: Searching Active Audit Events

Jump to solution

Hi Steve,

Apologies in the long delay in getting back to you.  I've tried out your search script and it works brilliantly.

Thanks for your help

RAy

0 Likes
RayM1 Trusted Contributor.
Trusted Contributor.

Re: HPE RM: Searching Active Audit Events

Jump to solution

Hi Darren, apologies in the late responce.  I tried out a search script from Steve the other responder and it will work for what I want to do.  Thanks for replying to my query.

Ray

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.