Newer Version Available

This content describes an older version of this product. View Latest

Report Event Type

Report events contain information about what happened when a user ran a report.

For details about event monitoring, see the Trailhead Event Monitoring module or REST API Developer’s Guide.

Fields

Field Details
AVERAGE_ROW_SIZE
Type
Number
Description
The average row size of all rows in the Report event, in bytes. A large average size, coupled with a high ROW_COUNT, can indicate that a user is downloading information for fraudulent purposes. For example, a salesperson who downloads all sales leads before departing for a competitor.
Example
700
CLIENT_IP
Type
String
Description
The IP address of the client that’s using Salesforce services. A Salesforce internal IP (such as a login from Salesforce Workbench or AppExchange) is shown as “Salesforce.com IP”.
Example
96.43.144.26
CPU_TIME
Type
Number
Description
The CPU time in milliseconds used to complete the request. This field indicates the amount of activity taking place in the app server layer, highlighting pieces of Apex or Visualforce code that need refactoring.
DB_BLOCKS
Type
Number
Description
Indicates how much activity is occurring in the database. A high value for this field suggests that adding indexes or filters on your queries would benefit performance.
DB_CPU_TIME
Type
Number
Description
Allows you to monitor trends in database uptime.
DB_TOTAL_TIME
Type
Number
Description
The time in nanoseconds for a database round trip. Compare this field to CPU_TIME to determine whether performance issues are occurring in the database layer or in your own code.
DISPLAY_TYPE
Type
String
Description
The report display type, indicating the run mode of the report.
Possible Values
  • D: Dashboard
  • S: Show Details
  • H: Hide Details
ENTITY_NAME
Type
String
Description
The name of the object affected by the trigger.
EVENT_TYPE
Type
String
Description
The type of event.
Example
ReportExport, URI, API, RestApi, and so on. For details, see EventLogFile Supported Event Types.
LOGIN_KEY
Type
String
Description
The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring.
Example
GeJCsym5eyvtEK2I
NUMBER_BUCKETS
Type
Number
Description
The number of buckets that were used in the report.
NUMBER_COLUMNS
Type
Number
Description
The number of columns in the report.
NUMBER_EXCEPTION_FILTERS
Type
Number
Description
The number of exception filters that are used in the report.
ORGANIZATION_ID
Type
Id
Description
The 15-character ID of the organization.
Example
00D000000000123
RENDERING_TYPE
Type
String
Description
The report rendering type, describing the format of the report output.
Possible Values
  • W: Web (HTML)
  • E: Email
  • P: Printable
  • X: Excel
  • C: Comma-separated values (CSV)
  • J: JavaScript Object Notation (JSON)
REPORT_ID
Type
Id
Description
The 15-character ID of the report that was run.
REPORT_ID_DERIVED
Type
Id
Description
The 18-character case insensitive ID of the report that was run.
REQUEST_ID
Type
String
Description
The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST_ID.
Example
3nWgxWbDKWWDIk0FKfF5DV
REQUEST_STATUS
Type
String
Description
The status of the request for a page view or user interface action.
Possible Values
  • S: Success
  • F: Failure
  • U: Undefined
  • A: Authorization Error
  • R: Redirect
  • N: Not Found
ROW_COUNT
Type
Number
Description
The number of rows that were processed in the Report event. High row counts, coupled with a high AVERAGE_ROW_SIZE, can indicate that a user is downloading information for fraudulent purposes. For example, a salesperson who downloads all sales leads before departing for a competitor.
Example
150
RUN_TIME
Type
Number
Description
The amount of time that the request took in milliseconds.
SESSION_KEY
Type
String
Description
The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started.
Example
d7DEq/ANa7nNZZVD
SORT
Type
String
Description
The sort column and order that was used in the report.
TIMESTAMP
Type
String
Description
The access time of Salesforce services.
Example
20130715233322.670
TIMESTAMP_DERIVED
Type
DateTime
Description
The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ)
Example
2015-07-27T11:32:59.555Z
URI
Type
String
Description
The URI of the page that’s receiving the request.
Example
/home/home.jsp
URI_ID_DERIVED
Type
ID
Description
The 18-character case insensitive ID of the URI of the page that’s receiving the request.
USER_ID
Type
Id
Description
The 15-character ID of the user who’s using Salesforce services through the UI or the API.
Example
00530000009M943
USER_ID_DERIVED
Type
Id
Description
The 18-character case insensitive ID of the user who’s using Salesforce services through the UI or the API.
Example
00590000000I1SNIA0

Usage

Example: Identify Large Report Exports by User

Get Report event type data from the EventLogFile object using REST:

1/services/data/v40.0/query?q=SELECT+Id+,+EventType+,+LogFile+,+LogDate+,+LogFileLength+FROM+EventLogFile+WHERE+
2    LogDate+>+Yesterday+AND+EventType+=+'Report'

After you download the report data to a ReportData database table, query it and filter on reports that were exported with high row counts and size:

1SELECT USER_ID FROM ReportData WHERE (RENDERING_TYPE=C OR RENDERING_TYPE=X OR RENDERING_TYPE=P) AND ROW_COUNT>150000 AND AVERAGE_ROW_SIZE>1500