Platform Data

The Platform Data API provides platform-agnostic, enterprise-grade observability across your Tableau Cloud deployment. Accessible through Tableau Cloud Manager (TCM) REST API, the Platform Data API offers a centralized way to retrieve auditing and usage data to monitor security, performance, and operational health.

Benefits of Platform Data API

The Platform Data API offers the following benefits:

Unified observability: Access all event data for the tenant and site from a single interface.
Platform agnostic: Pull data into your preferred tool or custom automation.
Scalability: Replace manual processes with RESTful API calls designed to handle large-scale Tableau Cloud deployments.
Near real-time monitoring: If licensed with Tableau+ or Tableau Enterprise edition, access high-frequency data so that you can respond to critical events.
Extended retention: If licensed with Tableau+ or Tableau Enterprise edition, keep event data for up to one year to meet compliance and auditing requirements.

Table of Contents

Benefits of Platform Data API
Understanding Platform Data
- When to use each data type
Step 1: Authenticate to Tableau Cloud Manager REST API
Step 2: List available files
Step 3: Generate download URLs
- Example requests
- Example responses
Step 4: Download and analyze data
Step 5: Pair event logs and entity snapshots

Understanding Platform Data

The Platform Data API provides access to two complementary types of data:

Event logs: Historical event data that captures what happened in your Tableau Cloud deployment. Event logs record user actions, system events, and security-related activities at both the tenant and site levels. This data is stored in JSON format.
Entity snapshots: Point-in-time snapshots of Tableau Cloud content and its components, such as workbooks, data sources, published connections, users, and groups. Entity snapshots capture the current state of what exists on your sites. This data is stored in Parquet format.

Note: You can test these methods using an open source tool available in GitHub, Tableau Cloud Platform Data Loader.

When to use each data type

Goals	Questions to answer	Platform Data file type	Required license
To understand events, user actions, or changes over time	Who accessed this workbook yesterday? What caused this authentication failure? Show me all failed sign-in attempts.	Event logs	See Event Update and Data Retention in the Tableau Cloud Help.
To understand the current state or metadata of content	How many workbooks exist in the Sales project? Which data sources are certified? List all users with Creator licenses.	Entity snapshots	Enterprise or Tableau+
To relate events to content for comprehensive analysis	Show access events for workbooks that are now deleted. Which users modified high-priority data sources? What was the state of this workbook when the error occurred?	Event logs and entity snapshots	Enterprise or Tableau+

Step 1: Authenticate to Tableau Cloud Manager REST API

Before you can use the Platform Data API, you must authenticate to the Tableau Cloud Manager (TCM) REST API. How you authenticate to the TCM REST API depends on whether you’re signing in for the first time or have previously signed in before.

First-time workflow: If authenticating to the TCM REST API for the first time, follow the steps described in Sign in to Tableau Cloud Manager REST API.
Returning workflow: If you’ve previously signed in to the TCM REST API, authenticate by using one of the following methods:
- Sign in with personal access token
- Sign in with unified access token JWT

Notes:

The sign in response returns the tenant ID that you’ll use in subsequent requests.
For site requests, you’ll need the site ID. To get site IDs of the sites on the tenant for subsequent requests, use the List Tenant Sites method.

Step 2: List available files

Retrieve a list of available files to download by calling the appropriate method based on the data type you need:

Event logs:

List Activity Logs for Tenant returns tenant-level events
List Activity Logs for Site returns site-level events

Entity snapshots:

List Entity Snapshots for Site returns entity snapshots for a site

You can filter the results by date range (startTime and endTime) and type (eventType for event logs, entityType for entity snapshots). If no parameters are included, the APIs return the last 24 hours of available data for all types.

About dates and date ranges

Start time and end time parameters are in UTC format. We recommend always specifying the start time. However, if the start time isn’t specified, the default is 24 hours before the request.
Seven days is the maximum time span that you can specify between start and end times in a single request. A range that exceeds seven days causes the request to fail.
Entity snapshots only: Start time must not exceed 14 days in the past.

Best practices

Timestamps generally represent when the records became available, not necessarily when the events or snapshots occurred. Consider the following best practices:

You can use dates to capture incrementally new data as it becomes available.
When searching for data within a particular time window, specify a wider range to ensure you capture all relevant data in your request. For event logs, add at least one hour on each side to the time range.

About data types

Event log types

There are two categories of event types: tenant events and site events.

Tenant events: Recorded activities that occur within the TCM platform
Site events: Recorded activities that occur within each site on the tenant

For a list of event types and corresponding parameters, see:

Entity snapshot entity types

Entity snapshots provide information about site-level content and components. For a list of entity types and corresponding parameters, see:

Entity Snapshot Site Entity Type Reference

Best practices

Because the eventType and entityType filters accept a single value per request, we recommend using these filters for ad hoc requests. For example, query no more than three types as separate requests. Making multiple requests for more types can cause a measurable impact on API call capacity and can cause API request limits to be reached quickly. For more information about these limits, see API request limits.
If interested in multiple types, call all types without a filter. Then use the GET methods to retrieve specific types you’re interested in.

Example requests

To list files, you need the tenant ID, and for site-level files, both the tenant ID and site ID. The tenant ID is returned after authenticating to the TCM REST API. To get the site ID, you can call the List Tenant Sites method.

Event logs - tenant

This request returns all tenant events 24 hours before the time of the request.

GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog

This request returns events from January 1 to January 7.

GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00

This request returns site creation (tcm_activity_log_access) activity from January 1 to January 7.

GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00&eventType=tcm_activity_log_access

Event logs - site

This request returns all site events 24 hours before the time of the request.

GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog

This request returns seven days of events from January 1 to January 7.

GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00

This request returns refresh token or personal access token redemption (hist_redeem_refresh_token) activity from January 1 to January 7.

GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00&eventType=hist_redeem_refresh_token

Entity snapshots

This request returns all entity snapshots 24 hours before the time of the request.

GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots

This request returns entity snapshots from January 1 to January 7.

GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00

This request returns visualization entity snapshots from January 1 to January 7.

GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00&entityType=views

Example responses

The response returns a list of file paths and their corresponding sizes (bytes), partitioned by tenant or site ID, date range, and type. What is returned is then filtered by the parameters you provide.

Note: For event logs, because tenant IDs aren’t returned as part of the path for site-level data, consider creating a tenant folder when managing or storing these files.

Event logs - tenant

{
  "files": [
    {
      "path": "tenant-9cde722f-1edc-4cdd-b76f-42d87b51c785/y=2026/m=01/d=01/h=0/eventType=tcm_activity_log_access/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.text",
      "size": 2112
    }
  ]
}

Event logs - site

{
  "files": [
    {
      "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=hist_redeem_refresh_token/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.text",
      "size": 1292
    }
  ]
}

Entity snapshots

{
  "files": [
    {
      "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=views/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.parquet",
      "size": 8192
    }
  ]
}

Step 3: Generate download URLs

To access the data, pick which file paths returned from the previous request to generate download URLs for. You’ll then use the paths in the request body of the appropriate GET method:

Event logs:

Entity snapshots:

Get Entity Snapshot for Site

Example requests

Event logs - tenant URI

The request returns a download URL for the “ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt” log file.

POST https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog

Event logs - tenant request body

{
  "files": [    
    "tenant-9cde722f-1edc-4cdd-b76f-42d87b51c785/y=2026/m=01/d=01/h=0/eventType=tcm_activity_log_access/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt"
  ]
}

Event logs - site URI

The request returns download URLs for the specified event log files.

POST https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog

Event logs - site request body

The request must include a comma-separated list of paths from the previous request.

{
  "files": [    
    "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=hist_redeem_refresh_token/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt", 
    "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=background_job/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.txt "
  ]
}

Entity snapshots - site URI

The request returns download URLs for the specified entity snapshot files.

POST https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots

Entity snapshots - site request body

The request must include a comma-separated list of paths from the previous request.

{
  "files": [    
    "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=views/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.parquet", 
    "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=workbooks/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.parquet"
  ]
}

Example responses

The response produces the original file paths and corresponding download URLs to access the files. The URLs expire after 10 minutes.

Important: Because the download URLs allow unauthenticated access to your data, treat these URLs as sensitive information and don’t share with anyone.

Event logs - tenant

{
  "files": [    
  {
  "path": "tenant-9cde722f-1edc-4cdd-b76f-42d87b51c785/y=2026/m=01/d=01/h=0/eventType=tcm_activity_log_access/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt",
  "url": "https://m1jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/tenant%3D9cde722f-1edc-4cdd-b76f-42d87b51c785/y%3D2026/m%3D01/d=01/h=0/eventType=tcm_activity_log_access/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..."
  }
 ]
}

Event logs - site

{
  "files": [    
  {
  "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=hist_redeem_refresh_token/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt",
  "url": "https://activity-log-site-prod-ca-a.s3.ca-central-1.amazonaws.com/jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/pod%3Dprod-ca-a/siteLuid%3D33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=hist_redeem_refresh_token/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..."
  }, 
  {
  "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=background_job/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.txt",
  "url": "https://activity-log-site-prod-ca-a.s3.ca-central-1.amazonaws.com/jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/pod%3Dprod-ca-a/siteLuid%3D33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=background_job/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.txt?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..."
  }
 ]
}

Entity snapshots - site

{
  "files": [    
  {
  "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=views/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.parquet",
  "url": "https://entity-snapshot-site-prod-ca-a.s3.ca-central-1.amazonaws.com/jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/pod%3Dprod-ca-a/siteLuid%3D33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=views/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.parquet?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..."
  }, 
  {
  "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=workbooks/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.parquet",
  "url": "https://entity-snapshot-site-prod-ca-a.s3.ca-central-1.amazonaws.com/jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/pod%3Dprod-ca-a/siteLuid%3D33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=workbooks/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.parquet?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..."
  }
 ]
}

Step 4: Download and analyze data

Programmatically open each URL returned from the previous request or copy and paste the URL in a browser to download each file. After you’ve downloaded the files, ingest them into your preferred analytics platform for analysis.

File formats and tools

Event logs are in JSON format. You can:

Open them in a text editor to view individual events
Import them into analytics platforms like Tableau, Splunk, Snowflake, or other tools that support JSON ingestion

Entity snapshots are in Parquet format. You can:

Read them using tools like Apache Spark, Python (pandas, pyarrow), or DuckDB
Import them into analytics platforms like Tableau, Snowflake, or other tools that support Parquet files

Using analytics tools

You can ingest Platform Data into various analytics and monitoring platforms:

Tableau: Import JSON or Parquet files directly or publish them as data sources for visualization and analysis.
Splunk: Use Splunk’s data ingestion agents to monitor and index event log files. For detailed integration steps, refer to the Splunk documentation.
Snowflake: Load event log and entity snapshot data into Snowflake for data warehousing and analytics. See the Snowflake documentation for integration guidance.
Other platforms: Most analytics platforms support JSON and Parquet data ingestion. Consult your platform’s documentation for specific integration steps.

For advanced use cases involving the integration of event logs with entity snapshots, see Integrate event logs and entity snapshots.

Example data

Event logs - tenant

For example, an event log download URL might produce the following JSON data when opened in a text editor.

{"eventId":"bbce137f-12ce-4eaf-b4eb-fd0d42e521a0","tenantId":"9cde722f-1edc-4cdd-b76f-42d87b51c785","eventType":"tcm_activity_log_access","eventVersion":"0.1","eventProcessedTime":"2026-01-04T21:08:46.819Z","initiatingUserIPAddress":"155.000.00.00","eventProcessedTimeEnd":"2026-11-04T21:08:43.022551Z","siteName":null,"initiatingUserAgent":"PostmanRuntime/7.42.0","initiatingSessionId":"166a62f4-8bbc-4020-918e-a8b15dc36ff3","siteUri":null,"podUri":null,"eventProcessedTimeStart":"2026-01-13T21:08:43.022Z","initiatingUrl":"https://mytenant.manage.online.tableau.com/api/v1/tenants/9cde722f-1edc-4cdd-b76f-42d87b51c785/activitylog","tenantUri":"mytenant","initiatingUserEmail":"snguyen@example.com","tenantName":"mytenant","eventOutcome":"success","eventTime":"2026-01-14T21:08:43.028Z","siteId":null,"initiatingUserRole":"TCM_ADMIN","initiatingUserDisplayName":". snguyen@yourcompany.com","eventTypeAccessed":null,"eventOutcomeReason":null,"initiatingUserId":"33d345e6-a011-4992-8db0-94768451e54e"}
{"eventId":"bbce137f-12ce-4eaf-b4eb-fd0d42e521a1","tenantId":"9cde722f-1edc-4cdd-b76f-42d87b51c785","eventType":"tcm_activity_log_access","eventVersion":"0.1","eventProcessedTime":"2026-11-04T21:10:37.123Z","initiatingUserIPAddress":"155.000.00.00","eventProcessedTimeEnd":"2026-01-04T21:08:43.022551Z","siteName":null,"initiatingUserAgent":"PostmanRuntime/7.42.0","initiatingSessionId":"166a62f4-8bbc-4020-918e-a8b15dc36ff3","siteUri":null,"podUri":null,"eventProcessedTimeStart":"2026-01-14T21:10:34.331Z","initiatingUrl":"https://mytenant.manage.online.tableau.com/api/v1/tenants/9cde722f-1edc-4cdd-b76f-42d87b51c785/activitylog","tenantUri":"mytenant","initiatingUserEmail":"snguyen@example.com","tenantName":"mytenant","eventOutcome":"success","eventTime":"2026-01-14T21:10:27.001Z","siteId":null,"initiatingUserRole":"TCM_ADMIN","initiatingUserDisplayName":". snguyen@example.com","eventTypeAccessed":null,"eventOutcomeReason":null,"initiatingUserId":"33d345e6-a011-4992-8db0-94768451e54e"}

Event logs - site

For example, an event log download URL might produce the following JSON data when opened in a text editor.

{"eventId":"8102722e-3033-4112-8a48-8f5ce8e2411d","siteLuid":"33d345e6-36bd-4411-91e2-1c9fc849564e","eventType":"hist_redeem_refresh_token","eventVersion":"0.2","eventCategory":"security","eventTime":"2026-01-04T22:02:33.798536347Z","eventProcessedTime":"2026-01-04T22:02:45.38829Z","siteRoleId":11,"actorUserId":221648,"systemAdminLevel":0,"licensingRoleName":"Tier_Author","eventOutcome":null,"refreshTokenGuid":"76113549-ea79-4c74-8220-751af05af6da","siteName":"mysite","actorUserLuid":"2fe6101f-99d1-434c-8ce2-6cebe5a73d44","deviceName":"ws1-ltmjqxm","initiatingUserLuid":"2fe6101f-99d1-434c-8ce2-6cebe5a73d44","eventOutcomeReason":null,"initiatingUserId":221648}
{"eventId":"6254977f-3033-4112-8a48-8f5ce8e2411d","siteLuid":"33d345e6-36bd-4411-91e2-1c9fc849564e","eventType":"hist_redeem_refresh_token","eventVersion":"0.2","eventCategory":"security","eventTime":"2026-01-010T11:05:35.51477Z","eventProcessedTime":"2026-01-010T11:05:59.352Z","siteRoleId":11,"actorUserId":224144,"systemAdminLevel":0,"licensingRoleName":"Tier_Author","eventOutcome":null,"refreshTokenGuid":"76164888-ea79-4c74-8220-751af05af6da","siteName":"mysite","actorUserLuid":"2ef2495f-99d1-434c-8ce2-6cebe5a73d44","deviceName":"ws2-qxltmmj","initiatingUserLuid":"2ef2495f-99d1-434c-8ce2-6cebe5a73d44","eventOutcomeReason":null,"initiatingUserId":224144}

Entity snapshots

{"view_id":"3a0c97cb-1fca-4c32-94a5-3849dc14cfa8","name":"Sales Performance Dashboard – Overview","content_url":"sales-performance-dashboard/overview","created_at":"2025-11-15T18:22:46.000","updated_at":"2026-01-03T18:22:46.000","workbook_id":"f5dc784b-56c0-42c0-a67e-a025e4a7c251","workbook_name":"Sales Performance Dashboard","project_id":"a1b2c3d4-0001-0001-0001-000000000001","project_name":"Sales","owner_id":"2fe6101f-99d1-434c-8ce2-6cebe5a73d44","owner_name":"jsmith","total_views":595,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"}
{"view_id":"4dd18aa6-915e-4fe2-a5d8-9a26e09d3a87","name":"Marketing KPIs – Overview","content_url":"marketing-kpis/overview","created_at":"2025-09-02T01:09:54.000","updated_at":"2025-09-21T01:09:54.000","workbook_id":"fd71654b-7402-4bb2-9553-f847f89ebdc8","workbook_name":"Marketing KPIs","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":635,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"}
{"view_id":"57912241-bd8b-426a-8829-5475d9c3e224","name":"Marketing KPIs – Detail","content_url":"marketing-kpis/detail","created_at":"2025-09-02T01:09:54.000","updated_at":"2025-09-21T01:09:54.000","workbook_id":"fd71654b-7402-4bb2-9553-f847f89ebdc8","workbook_name":"Marketing KPIs","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":696,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"}
{"view_id":"f74f8247-12b3-445e-a4c4-be5bcf367f32","name":"Marketing KPIs – Trend","content_url":"marketing-kpis/trend","created_at":"2025-09-02T01:09:54.000","updated_at":"2025-09-21T01:09:54.000","workbook_id":"fd71654b-7402-4bb2-9553-f847f89ebdc8","workbook_name":"Marketing KPIs","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":103,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"}
{"view_id":"070f981d-0f9f-4058-892f-9d573162fab0","name":"Ops Efficiency Report – Overview","content_url":"ops-efficiency-report/overview","created_at":"2025-08-29T22:38:34.000","updated_at":"2025-10-08T22:38:34.000","workbook_id":"aaaf29f2-2790-4fed-a376-5b9535f8b9bd","workbook_name":"Ops Efficiency Report","project_id":"a1b2c3d4-0001-0001-0001-000000000001","project_name":"Sales","owner_id":"2fe6101f-99d1-434c-8ce2-6cebe5a73d44","owner_name":"jsmith","total_views":693,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"}
{"view_id":"708ec15b-09d8-4c25-891b-7deaa5e4e8d6","name":"Pipeline Funnel – Overview","content_url":"pipeline-funnel/overview","created_at":"2025-09-26T06:51:51.000","updated_at":"2025-11-12T06:51:51.000","workbook_id":"71acab53-58ea-4299-b322-293a621e0240","workbook_name":"Pipeline Funnel","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":653,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"}
{"view_id":"cd9cd828-531d-4ee6-906b-759e78b09ed6","name":"Pipeline Funnel – Detail","content_url":"pipeline-funnel/detail","created_at":"2025-09-26T06:51:51.000","updated_at":"2025-11-12T06:51:51.000","workbook_id":"71acab53-58ea-4299-b322-293a621e0240","workbook_name":"Pipeline Funnel","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":984,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"}

Step 5: Pair event logs and entity snapshots

Event logs and entity snapshots are complementary data that, when combined, provide comprehensive observability of your Tableau Cloud deployment. Event logs capture historical events (what happened), while entity snapshots capture the current state of content and components (what exists). We recommend getting the latest entity snapshot of your site and collate various event logs created over time to create a single set of data that can be queried for your analysis. By pairing these data together, you can perform advanced analytics that relate events to their entities.

Common use cases

Integrating event logs and entity snapshots enables you to:

Analyze deleted content: Query activity related to workbooks, data sources, or users that no longer exist by joining historical events with past entity snapshots.
Track content evolution: Understand how entities have changed over time by correlating events with entity states.
Audit and compliance: Combine who did what (event logs) with what existed at the time (entity snapshots) for comprehensive audit trails.
Usage and performance analysis: Relate performance events to specific content characteristics captured in entity snapshots.
Tenant-level analysis: Enables you to combine data across all sites within a tenant for comprehensive reporting and analysis.

Example - Tableau

To pair event logs and entity snapshots in your analytics platform:

Download both sets of data using the methods described in the previous sections.
- For event logs, collate the event logs for the site, multiple sites, or the tenant
- For entity snapshots, get the latest data for the site or collate the latest data for multiple sites
Load the data into Tableau
Use full outer joins to relate event logs and entity snapshots. This allows you to query events and entities even when one side of the relationship may not exist (such as deleted workbooks).
Join on common fields such as:
- Workbook ID (workbook_id, workbookId)
- Data source ID (datasource_id, datasourceId)
- User ID (user_id, userId)
- Site ID (site_id, siteId) By joining on these fields, you can answer questions like:
- “Show me all access events for workbooks in the Sales project”
- “Which users accessed data sources that are now deleted?”
- “What was the state of a workbook when a specific error occurred?”

Best practices

Specify appropriate time ranges: When querying event logs, use time ranges that align with your entity snapshot collection schedule to ensure consistency.
Account for deleted entities: Use full outer joins to preserve events related to entities that might have been deleted since the snapshot was taken.
Optimize for your use case: If you’re only interested in current entities, use inner joins. If you need a complete audit including deleted content, use full outer joins.
Use tenant-level data: Take advantage of tenant-level access to analyze patterns across all sites or compare activity between sites.