Best Practices and Considerations for Leveraging Event Log Object Data

Querying Event Log Object Data Through SOQL

As of Spring 25’, the Event Log Object framework only supports SOQL queries, with the following exceptions:

• Relationship queries
• HAVING
• OFFSET

Note Event Log Objects are designed for users with specific permissions to perform interactive analytics and diagnose security and performance incidents via SOQL. This feature is not meant to handle concurrent queries from a large number of users.

Timestamp Field Considerations

The only supported date function for the Timestamp field in a where clause within the Event Log Object framework is DAY_ONLY(). See Date Functions for more information on querying data by date periods.

You can query up to 15 days of data at a time using the Timestamp filter present on all event log objects. Consequentially, expect these behaviors when querying using the Timestamp field:

• When there are 3 or more Timestamp filters in the WHERE clause, we block the execution of the query with an error.
•  != isn’t supported
• When the Timestamp filter isn’t specified in the query, we append a filter in the backend to query only the last 15 days of data.
• If you are specifying Timestamp filters as part of an AND condition, the time range must fall within 15 days.
• No more than 2 Timestamp filters can be used for OR and IN operators.
• If a full range isn’t specified in the Timestamp filter (for example, if either the upper or lower bound is missing) the filter automatically retrieves 15 days of data in the direction of the missing bound.