Explorer¶
The Explorer is the raw audit-log search. Use it when you need the individual rows behind a chart, a user, a case, or a process.
Filters¶
The filter row always shows the active filters as chips. Click Filters to open the controls, and click the × on a chip to remove that filter.
When no filter is active, an All chip is shown. It means "no restriction".
| Filter | Behavior |
|---|---|
| Event type | Multi-select from the workspace's event types |
| Level | Multi-select: error, warning, info, success |
| User | Multi-select from workspace users |
| Process | Text contains match |
| Case | Text contains match |
| Task | Text contains match |
| Outcome | Multi-select from action outcomes |
| Role | Multi-select from user roles |
| Session type | Multi-select: web, API |
| IP | Text contains match |
Filters combine with AND: a row must match every active filter.
Time range¶
The Explorer uses rolling ranges (resolved when the query runs) rather than calendar presets:
- Last 15 minutes, last hour, last 24 hours, last 7 days, last 30 days, last 3 months, last 6 months, last year
- Year to date
- Custom: start/end date plus a start/end time, interpreted in your timezone
The default is last 24 hours. Custom bounds are converted to UTC for the query, so they are DST-safe.
Views¶
- Summary — time, level, event, action, outcome, user, process, case, task.
- Detailed — adds role, object, client information, server information, session, workspace, app version, and log ID.
Switch views with the control above the table. The table header stays visible even when no rows match.
Pagination and auto-refresh¶
- Page sizes: 10, 25, 50, 100 (default 25).
- Changing filters resets to page 1; pagination and page-size changes keep the page they target.
- Auto-refresh cycles through Off → 10s → 30s → 1m → 5m. Auto-refresh keeps the current page.
Log detail¶
Click any row to open a right-side panel with every raw field of that event, including fields that are not columns in the table.
Export¶
The Explorer does not currently have an export control. To download events, use the case or process detail pages; see Exports.
If something looks wrong¶
- No rows: widen the time range, clear a chip, or check that you are in the right workspace.
- An error alert: the query failed; retry or narrow the filters. The dashboard shows a structured message instead of a stack trace.