Audit trail use cases

This article provides instructions for the following common audit trail use cases:

• Find a deleted equipment record
• Find a task that was removed from a work order
• Find a specific field-level change
• Parse the Event Data column in user management files

Find a deleted equipment record

To find out when an equipment record was deleted:

1. Go to Audit Trail.
2. Click the Equipment tab.
3. In the date range fields, select the date range you think the record was deleted in (e.g. the past 6 months).
4. If you know the equipment’s asset code, enter it in the Assets filter:
   
5. Click Download.
6. Open the file in Excel.
7. If you need to filter the results, do any of the following:
   • Filter the Service column by Asset. This displays only changes to the equipment record itself.
   • Filter the Action (CRUD) column by DELETE. This displays only deletions.
8. In the filtered results, look for the deleted asset. In the example below, an admin deleted asset A116 on August 9:
   

Find a task that was removed from a work order

To find a task that was removed from a work order:

1. Go to Audit Trail.
2. Make sure that you’re in the Work Orders tab.
3. In the date range fields, select the date range you think the task was removed during (e.g. the past week).
4. In the Work Orders filter, enter the code for the work order that the task was removed from:
   
5. Click Download.
6. Open the file in Excel.
7. If you need to narrow the results, do any of the following:
   • Filter the Service column by WorkOrderTask. This displays only changes to the work order’s tasks.
   • Filter the Action (CRUD) column by DELETE. This displays only deletions.
8. In the filtered results, look for the task that was deleted. In the example below, an admin deleted two tasks from work order 17131:
   

Find a specific field-level change

To find a change to a specific field in a work order or equipment record:

1. Go to Audit Trail.
2. Click either the Work Orders or Equipment tab (depending on which type of audit trail you want to view).
3. In the date range fields, select the date range you think the change happened during (e.g. the past 2 weeks).
4. In the Filter by section, use the filters provided to narrow your results. For example, if you want to find a change made to a specific work order, enter its code in the Work Orders filter:
   
5. Click Download.
6. Open the file in Excel.
7. Use the work order or equipment data dictionary to find the service and key that correspond to the field you're looking for. For example, to find changes to a work order’s Summary of Issue field, you would be looking for the “Description” key in the “WorkOrder” service.
8. Filter the Service column by the service you identified in step 7. Continuing the example above, you would filter for “WorkOrder”.
9. Filter or search for the key you identified in step 7. Continuing the example above, you would look for “Description”:
   
   In the example above, an admin changed the work order’s description on August 14.

Parse the Event Data column in user management files

In audit trail files for user management, the details about each change are displayed as JSON events in the Event Data column:

You can use built-in Excel tools to parse these values so that they’re easier to read:

To parse the event data:

1. In Excel, click Data > Get Data (Power Query):
   
2. Click Text/CSV:
   

3. Click Browse.

4. Select your audit trail CSV file.

5. Click Get Data:
   

6. Click Next.
7. Click Transform data:
   
8. Click the header for the Event Data column:
   
9. In the Transform tab, click Parse > JSON:
   
10. To view the details of a specific record, click its cell in the table:
    
    Tip: If you click the empty part of the cell (instead of clicking the word “Record”), the details are displayed just below the table, rather than opening in a new screen, which makes it easier to navigate between records: