Search query for old value of cloudLifecycleState

[sreeram (Sreeram N)]

Hi Team,

Is there a way to get the old value of the cloudlLifecycleState via SailPoint search?

For example: Identity A’s current CLS is X and the old value is Y. I would ideally like to get the old value of CLS ie. ‘Y’ and current value ‘X’ leverage them for a report.

I would appreciate any and all input.

[shaileeM (Shailee Mehta)]

Hi @sreeram ,

If you plan to use Saved searches for reports, you can create a saved search from Search functionality using query: attributes.attributeName:"cloudLifecycleState", filter your search by Events and select the column Info from the column chooser. The value of Info column holds the old and the new value of the changed attribute. e.g newState:<new value> previousState:<old value>

Another option is to use Search API to generate the report. Response for below API gives “Info” in the JSON response which contains old and new values of the attribute that changed.

Search API Body:

{
   "indices": [
        "events"
    ],
    "query": {
        "query": "attributes.attributeName:\"cloudLifecycleState\""
    }
}

The response would contain :

 "attributes": {
            "oldState": "<old value>",
            "newState": "<new value>",
            "sourceName": "null",
            "info": "newState:<new value> previousState:<old value>",
            "interface": "Cloud Lifecycle Change",
            "attributeName": "cloudLifecycleState",
            "attributeValue": "<new value>"
        }

[udayputta]

Like Shailee mentioned you can do it by fetching the events. you can also use the below query to find the events in a single call. Here this will return all the events that has old value as active.
attributes.attributeName:cloudLifecycleState AND attributes.oldState:“active”