Print this page

Interpreting Report Metadata from Security Logs

Knowledge Article Number 000199305
Description

Interpreting Report Metadata

Once a security log has been retrieved, any reports that have been exported will appear as a block of report metadata (in the form of Key/Value pairs). This article addresses the information contained within the metadata and how to interpret it. For ease of reading the code, we recommend inserting a carriage return prior to each ampersand (&). This will allow each Key/Value pair to be viewed on a separate line.
Resolution

Report Type

This will determine what objects are included in the report. If the Report Type is a numeric value rather than an Entity ID, it indicates it is a Salesforce Standard Report Type and can be found below in the Standard Report Types table. If the Report Type is an Entity ID, it is a Custom Report Type.

&rt= [Report Type]


Standard Filters

These will generally include the Date/Time field and range.

&colDt_c= [Date/Time Field]
&colDt_e= [Range End]
&colDt_q= [Range Description]
&colDt_s= [Range Start]

Note: An “all time” report will not have a start or end value and will show “custom” for the Range Description.


Advanced Filters

These are custom filters to refine the report results.

&pcX= [Filter Field]
&pnX= [Filter Operator]
&pvX= [Filter Value]

There are three components to each filter: Field, Operator, Value. These appear as &pcX=, &pnX=, and &pvX=, respectively. The "X" component will increment depending on the number of filters.

For example, a report with two filters will include the following:

&pc0=[Field1]&pc1=[Field2]&pn0=[Operator1]&pn1=[Operator2]&pv0=[Value1]&pv1=[Value2]

 

This can be broken down as follows:

Filter 1: &pc0=[Field1] , &pn0=[Operator1] , &pv0=[Value1]
Filter 2: &pc1=[Field2] , &pn1=[Operator2] , &pv1=[Value2]

Operators appear as two-character codes.

 
CodeOperator
eqEquals
neNot equal to
coContains
ncDoes not contain
swStarts with
gtGreater than
ltLess than
geGreater or equal
leLess or equal
 

Filter Logic

Filter logic (for example: "1 AND 2 AND ( 3 OR 4 OR 5 ) AND 6") does not appear in security log metadata.

 

Additional Report Details

Other report attributes can also be extracted.

 

&cust_name= [Report Name]
&cust_devName= [API Name]
&cust_desc= [Report Description]
&cust_owner= [Report Owner]
&last_modified_by= [Last Modified User Name]
&last_modified_date= [Last Modified Date]
&last_modified_user_id= [Last Modified User ID]
&id= [Report ID]

Notes on formatting: A plus sign (+) indicates a space. Other special characters will be encoded. Please see the chart below for common encoded characters.

Note on EntityIDs: 
You can determine what object or record the EntityID refers to by entering the EntityID in the Address Bar after the "salesforce.com/" portion of the organization URL.

For example: https://na1.salesforce.com/[EntityID]

This will display the details for whatever entity has been entered.

 

Standard Report Types

&rt=Report Type&rt=Report Type&rt=Report Type
01ACCOUNT_LIST22OPPORTUNITY_LIST44LEAD_OWNER
02CONTACT_LIST24ACTIVITY_LIST45ACCOUNT_PARTNER
03TRAINING25OPPORTUNITY_SCHEDULE46CONTRACT_LIST
04CAMPAIGN_LIST26OPPORTUNITY_CONTACT47ACCOUNT_OWNER
05CAMPAIGN_CALLDOWN27OPPORTUNITY_HISTORY48DOCUMENT_LIST
06CAMPAIGN_CONTACT28OPPORTUNITY_LEAD49ACCOUNT_TEAM
07CAMPAIGN_LEAD29OPPORTUNITY_PARTNER50OPPORTUNITY_COMPETITOR
08CAMPAIGN_MEMBER30OPPORTUNITY_PRODUCT51CUSTENT
09CAMPAIGN_OPPORTUNITY31OPPORTUNITY_TEAM52ACCOUNT_CUSTENT
10CASE_LIST32USER_LIST53CONTACT_CUSTENT
11EMAIL_STATUS33SOLUTION_LIST54LEAD_CUSTENT
12FORECAST34CSS_USAGE55OPPORTUNITY_CUSTENT
13FORECAST_ACTUAL35CSS_USER56CAMPAIGN_CUSTENT
14FORECAST_HISTORY36ACTIVITY_CONTRACT57CASE_CUSTENT
15ACTIVITY_ACCOUNT37ACTIVITY_CAMPAIGN58CONTRACT_CUSTENT
16ACTIVITY_CASE38PAYMENT_LIST59CUSTENT_CUSTENT
17ACTIVITY_CONTACT39INVOICE_LIST60PRODUCT_LIST
18ACTIVITY_LEAD40INVOICE_ITEM61PRICEBOOK_PRODUCT
19ACTIVITY_OPPORTUNITY41ORDER_LIST62CONTRACT_APPROVAL
20LEAD_CHART42ORDER_ITEM63CASE_HISTORY
21LEAD_LIST43BILLED_PRODUCT64PRODUCT_OPPORTUNITY
 

Common Encoded Characters

CharacterCodeCharacterCodeCharacterCode
!%21,%2C[%5B
"%22-%2D\%5C
#%23.%2E]%5D
$%24/%2F^%5E
%%25:%3A_%5F
&%26;%3B`%60
'%27<%3C{%7B
(%28=%3D|%7C
)%29>%3E}%7D
*%2A?%3F~%7E
+%2B@%40  
Also See - Interpreting the Forensic Logs
 




promote demote