Monitor dashboard usage with audit logs

  • Article

Important

This feature is in Public Preview.

This article provides sample queries that workspace admins can use to monitor activity associated with AI/BI dashboards. All queries access the audit logs table, which is a system table that stores records for all audit events from workspaces in your region.

For a comprehensive reference of available audit log services and events, see Diagnostic log reference.

Monitor draft and published dashboards

The examples in this section demonstrate how to retrieve audit logs for common questions about dashboard activity.

How many dashboards were created in the past week?

The following query returns the number of dashboards that were created in your workspace over the past week.


SELECT
  action_name,
  COUNT(action_name) as num_dashboards
FROM
  system.access.audit
WHERE
  action_name = "createDashboard"
  AND event_date >= current_date() - interval 7 days
GROUP BY
  action_name

The following image shows example query results:

Sample query results showing the number of dashboards created in the previous week.

Most examples in this article focus on auditing activity on a specific dashboard. You can use audit logs to retrieve specific dashboard IDs. The following query retrieves dashboards with the most views by counting the getDashboard and getPublishedDashboard actions associated with the IDs.

SELECT
  request_params.dashboard_id as dashboard_id,
  COUNT(*) AS view_count
FROM
  system.access.audit
WHERE
  action_name in ("getDashboard", "getPublishedDashboard")
GROUP BY
  dashboard_id
ORDER BY
  view_count DESC

The following image shows example query results:

Sample query results showing dashboard IDs and a view count.

How many times was this dashboard viewed in the past week?

The following query uses a specific dashboard_id to show the number of times the dashboard was viewed in the past week. The action_name column shows whether the draft or published dashboard was accessed. getPublishedDashboard refers to views of the published dashboard. getDashboard refers to views of the draft dashboard. When you run the query, substitute <dashboard_id> with the UUID string associated with a dashboard in your workspace.


SELECT
  action_name,
  COUNT(action_name) as view_count
FROM
  system.access.audit
WHERE
  request_params.dashboard_id = "<dashboard_id>"
  AND event_date >= current_date() - interval 7 days
  AND action_name in ("getDashboard", "getPublishedDashboard")
GROUP BY action_name

The following image shows example query results:

Sample query results showing dashboard views by action name.

Who were the top viewers in the past week?

The following query identifies the users who view a specific dashboard most frequently in the past week. It also shows whether those views were on draft or published dashboards. For this query, the dashboard id is provided as a parameter. To learn more about using dashboard parameters, see Work with dashboard parameters.

SELECT
  user_identity.email as user_email,
  action_name,
  COUNT(action_name) as view_count
FROM
  system.access.audit
WHERE
  request_params.dashboard_id = :dashboard_id
  AND event_date >= current_date() - interval 7 days
  AND action_name in ("getDashboard", "getPublishedDashboard")
GROUP BY action_name, user_email

The following image shows example query results:

Sample query results showing dashboard views by user and action name.

Monitor embedded dashboards

You can monitor activity on embedded dashboards using the audit logs for workspace events. To learn about other workspace events that appear in the audit log, see Workspace events.

The following query retrieves details for dashboards that have been embedded in external websites or applications.


SELECT
  request_params.settingTypeName,
  source_ip_address,
  user_identity.email,
  action_name,
  request_params
FROM
  system.access.audit
WHERE
  request_params.settingTypeName ilike "aibi%"

The following image shows example query results:

Sample query results showing details for embedded dashboards.