Activity Log
Tableau Cloud records event logs for tenant and site activity as JSON text files. Your license edition determines how you can access the logs, how often they update, and how long data is retained. For more information, see Event update frequency and data retention.
Use these logs to:
-
View and analyze event data: Access detailed event data for Tableau Cloud, capturing compliance information and tracking activities on your tenants and sites. All events include a timestamp and the ID of the actor, and if relevant, the ID of the affected content.
-
Audit permissions changes: Track and audit permissions changes, such as adding or removing users from a group, moving content between projects, and explicitly changing content permissions. This is essential for implementing robust controls for compliance purposes.
-
Supplement Admin Insights: Enhance the information provided by Admin Insights and Admin Views to track site activity and usage metrics. You can integrate Activity Log data with monitoring tools, such as Splunk or Amazon EventBridge to query log fields and answer questions like the last 10 actions taken by a user, who last performed an event on content, and what the last action on content was.
Accessing Activity Log events
Before you jump into Activity Log, it’s important to understand the different event types in Tableau Cloud and how to access them.
Tenant events
Tenant events record changes that occur within Tableau Cloud Manager (TCM). These include activities like assigning users access and roles on a site, changing site role capacity limits, and monitoring license consumption across multiple sites. Tenant events are accessed using the TCM REST API(Link opens in a new window) administrative methods, also called the Platform Data API, by users with a Cloud Administrator role. For more information, see List tenant activity log paths(Link opens in a new window) and Batch generate tenant activity log download urls(Link opens in a new window) methods in TCM REST API Reference.
For a full list of Activity Log tenant events, see Activity Log Tenant Event Type Reference.
Site events
Site events record changes that occur within Tableau sites. These include activities like login successes and failures, permission changes, and user interactions with content.
Site events are accessed in two ways:
-
Using the Tableau Cloud Manager (TCM) REST API administrative methods, also called the Platform Data API, by users with a Cloud Administrator role. For more information, see TCM REST API Reference(Link opens in a new window).
-
Configuring the Activity Log to send log data to Amazon Simple Storage Service (S3) for analysis. For more information, see Set Up Activity Log.
For a full list of Activity Log site events, see Activity Log Site Event Type Reference.
Event update frequency and data retention
Depending on your license edition, there are different values for log update frequency and data retention.
| Tableau (default) | Advanced Management, Tableau Enterprise, and Tableau+ | |
|---|---|---|
| Access method | Tableau Cloud Manager REST API |
Tableau Cloud Manager REST API Customer-managed Amazon Simple Storage Service (S3) Bucket |
| Update frequency | 1 day* | Less than 15 minutes |
| Data retention | 14 days |
365 days
|
*Note: Logs are batched daily and typically arrive a few hours past midnight for the previous day's activity. The availability time is based on the local time zone of your site's pod. For example, a site hosted on prod-useast-a would see logs become available based on Eastern Time.