Retrieving of latest AuditEvent of a particular user

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Hi ,

I am trying to retrieve the latest auditEvent via beanshell code, but receiving all the events.

can anyone help for retrieving of latest AuditEvent of particular target .

Thanks,

Akash

2

Hi @AkashRaavi131,

please, share your query option conditions, so wee can help.

3

Hi @enistri_devo ,

Thank you, need to retrieve by using action,source,target options.
For Example: trying to retrieve action “provisioning_create”, target is user.

Thanks,

Akash

4

ok, but how about that you write now? If you share your code, I cand help you to fix it

5

Hi Akash,

Try something like this:

QueryOptions qo = new QueryOptions();
qo.addFilter(Filter.eq("target", identityName));
qo.addOrdering("created", false);
qo.setResultLimit(10);
List events = context.getObjects(AuditEvent.class, qo);
1 Like
6

Hi @AkashRaavi131

import sailpoint.object.AuditEvent;
import sailpoint.object.QueryOptions;
import sailpoint.object.Filter;

QueryOptions qo = new QueryOptions();

// target = identity name (or whatever your env stores in AuditEvent.target)
qo.addFilter(Filter.eq(“target”, identityName));

// optional filters (use only if you need them)
qo.addFilter(Filter.eq(“action”, “provisioning_create”));
// qo.addFilter(Filter.eq(“source”, “IdentityIQ”)); // if you know the exact source value

qo.addOrdering(“created”, false); // newest first
qo.setResultLimit(1);

List events = context.getObjects(AuditEvent.class, qo);
AuditEvent latest = (events != null && !events.isEmpty()) ? events.get(0) : null;
return latest;

If filtering by target doesn’t return anything, it usually means your system stores the user in a different field (sometimes identityName, accountName, etc.). In that case, print one AuditEvent in debug and confirm the field names/values, then adjust the filter.