In the Audit Trail Viewer utility, you can create queries to filter the precise events that you want to view.

Procedure

  1. Open the Audit Trail Viewer.
  2. Select Show Query (on the far right of the window).
  3. The application displays a combination of filters, as well as And operators and Or operators, to narrow down the search results.
  4. Define the rules in your query as follows:
  5. Select And if you want results that meet multiple conditions (returns fewer results) or select Or if you want results that meet any one of a list of conditions (returns more results).
  6. Select , then select Add Rule.
  7. Select the condition that you want to search for, such as Object Type, Timestamp, Username, and so on.
  8. Select an operator.
  9. Select or enter a target.
  10. (Optional) To add additional rules, select next to either the Or button or the text box.
  11. (Optional) To add an additional group to the query, select and choose Add Group.
  12. The Audit Trail Viewer adds a separate group to the query where you can create additional sets of rules.
  13. TIP

    Add a group to the query to create both an And rule and an Or rule.

  14. Select Run Query to test your query.

NOTE

If there are errors in the query, such as an empty value, an error message reports the issue (in the upper-right corner of the window).