Newer Version Available
Query Hourly Event Log Files
Suppose you’re an administrator. Your Chief Security Officer asks you to identify who modified specific accounts and opportunities in the past two hours. You query the hourly URI event log files using the EventLogFile object to review the page requests and request status. Because EventLogFile also returns 24-hour log files, use this SOQL syntax to filter out the 24-hour log files.
1curl https://MyDomainName.my.salesforce.com/services/data/v63.0/query?q=SELECT+Id+,+EventType+,+Interval+,+LogDate+,+LogFile+FROM+EventLogFile+WHERE+EventType+=+'URI'+AND+Interval+=+'Hourly' -H "Authorization: Bearer token"In the query, Interval=Hourly makes sure that only hourly event log file data is returned. Alternatively, you can use Sequence to filter out 24-hour event log files (Sequence!=0). To get both hourly and 24-hour files, use Sequence>=0.
If your sandbox org has URI events, you see log file records in your query results. You can also download the event log files to review the data in a CSV file. For more information, see Trailhead: Download and Visualize Event Log Files.