Report Event Type

Report events contain information about what happened when a user ran a report. This event type includes all activity that's in the Report Export event type, plus more. For example, it has user activity for reports exported as both Formatted Report and Details Only output.

Exporting a report directly from the report result captures the event in both the Report and Report Export logs.

Note

For details about event monitoring, see the Trailhead Event Monitoring module or REST API Developer’s Guide.

Fields

Field Details
AVERAGE_ROW_SIZE
Type
Number
Description
The average row size of all rows in the Report event, in bytes. A large average size, coupled with a high ROW_COUNT, can indicate that a user is downloading information for fraudulent purposes. For example, a salesperson who downloads all sales leads before departing for a competitor.
Example
700
CLIENT_IP
Type
String
Description
The IP address of the client that’s using Salesforce services. A Salesforce internal IP (such as a login from AppExchange) is shown as “Salesforce.com IP”.
For example: 96.43.144.26.
CPU_TIME
Type
Number
Description
The CPU time in milliseconds used to complete the request. This field indicates the amount of activity taking place in the app server layer.
DB_BLOCKS
Type
Number
Description
Indicates how much activity is occurring in the database. A high value for this field suggests that adding indexes or filters on your queries would benefit performance.
DB_CPU_TIME
Type
Number
Description
The CPU time in milliseconds to complete the request. Indicates the amount of activity taking place in the database layer during the request.
DB_TOTAL_TIME
Type
Number
Description
The time in nanoseconds for a database round trip. Includes time spent in the JDBC driver, network to the database, and DB_CPU_TIME. Compare this field to CPU_TIME to determine whether performance issues are occurring in the database layer or in your own code.
DISPLAY_TYPE
Type
String
Description
The report display type, indicating the run mode of the report.
Possible values are:
  • D—Dashboard
  • S—Show Details
  • H—Hide Details
ENTITY_NAME
Type
String
Description
The name of the object affected by the trigger.
EVENT_TYPE
Type
String
Description
The type of event. The value is always Report.
LOGIN_KEY
Type
String
Description
The string that ties together all events in a given user’s login session. It starts with a login event and ends with either a logout event or the user session expiring.
For example: GeJCsym5eyvtEK2I.
NUMBER_BUCKETS
Type
Number
Description
The number of buckets that were used in the report.
NUMBER_COLUMNS
Type
Number
Description
The number of columns in the report.
NUMBER_EXCEPTION_FILTERS
Type
Number
Description
The number of exception filters that are used in the report.
ORGANIZATION_ID
Type
Id
Description
The 15-character ID of the organization.
For example: 00D000000000123.
ORIGIN
Type
String
Description
The context in which the report executed, such as from a UI (Classic, Lightning, Mobile), through an API (synchronous, asynchronous, Apex), or through a dashboard.
Possible Values
  • ReportOpenedFromMobileDashboard: Report executed when a user clicked a dashboard component on a mobile device and drilled down to a report.
  • DashboardComponentUpdated: Report executed when a user refreshed a dashboard component.
  • DashboardComponentPreviewed: Report executed from a Lightning dashboard component preview.
  • ReportRunUsingSynchronousApi: Report executed from a synchronous API.
  • ReportRunUsingAsynchronousApi: Report executed from an asynchronous API.
  • ReportRunUsingApexSynchronousApi: Report executed from the synchronous Apex API.
  • ReportRunUsingApexAsynchronousApi: Report executed from the asynchronous Apex API.
  • ReportExported: Report executed from a printable view or report export that was not asynchronous nor an API export.
  • ReportRunFromClassic: Report executed from the Run Report option of Salesforce Classic.
  • ReportRunFromMobile: Report executed from the Run Report option of the mobile Salesforce app.
  • ReportRunFromLightning: Report executed from the Run option in Lightning Experience from a non-mobile browser.
  • ReportRunFromRestApi: Report executed from REST API.
  • ReportPreviewed: Report executed when a user got preview results while using the report builder.
  • ReportScheduled: Report was scheduled.
  • ProbeQuery: Report executed from a probe query.
  • ReportRunFromReportingSnapshot: Report executed through Snapshot Analytics.
  • ReportExportedAsynchronously: Report was exported asynchronously.
  • ReportExportedUsingExcelConnector: Report was exported using the Excel connector.
  • ChartRenderedOnVisualforcePage: Report executed from a rendered chart on a VisualForce Page.
  • ChartRenderedInEmbeddedAnalyticsApp: Report executed from a rendered chart in an embedded Analytics app.
  • ReportRunAndNotificationSent: Report executed through the notifications API.
  • ChartRenderedOnHomePage: Report executed from a rendered chart on the home page.
  • ReportResultsAddedToWaveTrending: Report executed when a user trended a report in CRM Analytics.
  • ReportAddedToCampaign: Report was added from an Add to Campaign action.
  • ReportResultsAddedToEinsteinDiscovery: Report executed synchronously from Einstein Discovery.
  • Unknown: Report execution origin is unknown.
  • Test: Report execution resulted from a test.
RENDERING_TYPE
Type
String
Description
Describes the format of the report output in Salesforce Classic. If the report was exported in Lightning Experience, this field is blank.
Possible Values
  • W: Web (HTML)
  • E: Email
  • P: Printable
  • X: Excel
  • C: Comma-separated values (CSV)
  • J: JavaScript Object Notation (JSON)
  • D: Dummy data
REPORT_ID
Type
Id
Description
The 15-character ID of the report that was run.
REPORT_ID_DERIVED
Type
Id
Description
The 18-character case insensitive ID of the report that was run.
REQUEST_ID
Type
String
Description
The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST_ID.
For example: 3nWgxWbDKWWDIk0FKfF5DV.
REQUEST_STATUS
Type
String
Description
The status of the request for a page view or user interface action.
For example:
  • S—Success. Salesforce handled the request successfully. If an Apex controller throws an exception, this status is also returned.
  • F—Failure. Typically 4xx or 5xx HTTP codes, such as no permission to view page, page took too long to render, page is read-only.
  • U—Undefined
  • A—Authorization Error
  • R—Redirect. Typically a 3xx HTTP code, possibly initiated by an Apex controller in a Visualforce page.
  • N—Not Found. 404 error.
This field can have a blank value.
ROW_COUNT
Type
Number
Description
The number of rows that were processed in the Report event. High row counts, coupled with a high AVERAGE_ROW_SIZE, can indicate that a user is downloading information for fraudulent purposes. For example, a salesperson who downloads all sales leads before departing for a competitor.
Example
150
RUN_TIME
Type
Number
Description
The amount of time that the request took in milliseconds.
SESSION_KEY
Type
String
Description
The user’s unique session ID. You can use this value to identify all user events within a session. When a user logs out and logs in again, a new session is started.
For example: d7DEq/ANa7nNZZVD.
SORT
Type
String
Description
The sort column and order that was used in the report.
TIMESTAMP
Type
String
Description
The access time of Salesforce services in GMT.
For example: 20130715233322.670.
TIMESTAMP_DERIVED
Type
DateTime
Description
The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ).
For example: 2015-07-27T11:32:59.555Z. Timezone is GMT.
UI_NUMBER_COLUMNS
Type
Number
Description
The number of columns in the report. The fields that have multiple components (for example, addresses) are considered as a single column.
URI
Type
String
Description
The URI of the page that’s receiving the request.
For example: /home/home.jsp.
URI_ID_DERIVED
Type
ID
Description
The 18-character case insensitive ID of the URI of the page that’s receiving the request.
USER_ID
Type
Id
Description
The 15-character ID of the user who’s using Salesforce services through the UI or the API.
For example: 00530000009M943
USER_ID_DERIVED
Type
Id
Description
The 18-character case insensitive ID of the user who’s using Salesforce services through the UI or the API.
For example: 00590000000I1SNIA0.
USER_TYPE
Type
String
Description
The category of user license.
Possible values are:
  • CsnOnly—Users whose access to the application is limited to Chatter. This user type includes Chatter Free and Chatter moderator users.
  • CspLitePortal—CSP Lite Portal license. Users whose access is limited because they’re organization customers and access the application through a customer portal or an Experience Cloud site.
  • CustomerSuccess—Customer Success license. Users whose access is limited because they’re organization customers and access the application through a customer portal.
  • Guest—Users whose access is limited so that your customers can view and interact with your site without logging in.
  • PowerCustomerSuccess—Power Customer Success license. Users whose access is limited because they’re organization customers and access the application through a customer portal. Users with this license type can view and edit data they directly own or data owned by or shared with users below them in the customer portal role hierarchy.
  • PowerPartner—Power Partner license. Users whose access is limited because they’re partners and typically access the application through a partner portal or site.
  • SelfService—Users whose access is limited because they’re organization customers and access the application through a self-service portal.
  • Standard—Standard user license. This user type also includes Salesforce Platform and Salesforce Platform One user licenses, and admins for this org.

Usage

Example: Identify Large Report Exports by User

Get Report event type data from the EventLogFile object using REST:

/services/data/v40.0/query?q=SELECT+Id+,+EventType+,+LogFile+,+LogDate+,+LogFileLength+FROM+EventLogFile+WHERE+
    LogDate+>+Yesterday+AND+EventType+=+'Report'

After you download the report data to a ReportData database table, query it and filter on reports that were exported with high row counts and size:

SELECT USER_ID FROM ReportData WHERE (RENDERING_TYPE=C OR RENDERING_TYPE=X OR RENDERING_TYPE=P) AND ROW_COUNT>150000 AND AVERAGE_ROW_SIZE>1500