Search query for identities that changed lifecycle state to inactive today

Hello,

Can you please help with a search query to get all identities that changed lifecycle state to inactive today ?

Thank you in advance!
Laks.

This will find Events and not Identities. At least in our tenant, the ‘Target’ value of the event is the employee ID of the identity.

name:"Change Identity State Passed" AND attributes.oldState:"active" AND attributes.newState:"inactive" AND created:[now-1d TO now]

3 Likes

Excellent solution! I agree that looking this up by event is the most accurate way to do it. If you want to use this query via search API instead of the UI, you can use the following payload.

{
  "indices": [
    "events"
  ],
  "query": {
    "query": "name:\"Change Identity State Passed\" AND attributes.oldState:\"active\" AND attributes.newState:\"inactive\" AND created:[now-1d TO now]"
  }
}
2 Likes

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.