Search native change detection events using attributes

[srivats28 (Srivats S)]

Hi Everyone,

We are looking to search for native change detection events based on an attribute change. In the events, we have an attribute called singleValueAttributeChanges We would like to leverage this attribute to identify and create a report for a specific change that occurred in native system. However this attribute’s data format looks like below -

[
    {
        "name": "XYZ",
        "newValue": "ABCD"
    },
    {
        "name": "EFG",
        "newValue": "HIJ"
    }
]

This is my search query currently name:native* AND attributes.sourceName:"XYZ"
I want to add the above attribute singleValueAttributeChanges in my search query. Any suggestions are appreciated. Thanks

[zachm117 (Zach Mullins)]

Hey @srivats28 !

You could try something like this:

name:"Update Native Change Detected" AND attributes.singleValueAttributeChanges:"*XYZ*"

Where ‘XYZ’ is the name of the attribute you want to search for. I tested this in my tenant and it seems to work as I would expect.

Please let me know if this helps!

• Zach

[srivats28 (Srivats S)]

Thanks, I had tried this as well and it worked. Appreciate your response!