Find Events related to a Specific Item
The September 2018 release of ArcGIS contained the ability to export an activity log, which contains history of actions made to content, members, organizations, and groups in your ArcGIS organization. This blog outlines some basics of understanding the history log: https://www.esri.com/arcgis-blog/products/arcgis-/administration/exploring-the-organization-activity...
This series of blogs will show quick ways of filtering the activity blog to find specific information. I've removed some information from the attached logs, so please note, IP address, org id and reqid are not included. This is also a fictional organization, with minimal events to make it easier to find specific events.
What happened to my item?
Scenario:
An item, b0a01e2e668f40168aa6d9a753efacb, that was supposed to be hidden until a press release on Wednesday, February 28, 2018. was made public early. Use the history log to determine who updated the items sharing privileges and when this occurred.
Detective Steps:
1. Download the Activity log setting the start date so that it will capture the time span in questions (Feb 26, 2018)
2. Open the CSV as an excel document
3. Input the itemID in the search bar in excel
4. Filter the action column to view all share actions
5. Look at the data column and determine which event updated the sharing to everyone:true.
Notice it appears that Donna Content username shared the item publicly right after Brandon Analyst shared with a specific group.