API Issue with accesslogs filter

[aggie87]

I seem to be having trouble filtering audit logs when there is a parenthesis in the search string. I escape the parenthesis and double encode it and still no joy

You can look at ANY audit log that contains a block in the format [Added property (<name of prop>:<value of prop>)]

If you search using this filter=description~"Added property %255c%2528" it will return all Added property results, but the second you add any character after the double encoded \( it returns nothing.

Am I doing something wrong?

the API call I am making would be something like this

{{baseUrl}}/setting/accesslogs?filter=description~"Added property %255c%2528p"

[stevevillardi]

I remember seeing an open issue for the v3 api for audit logs recently that seems vaguely familiar to this. Let me take a look when I'm back in the office tomorrow and see if I can validate it.

[stevevillardi]

Can you give this a shot? This seems to work for me:

Get-LMAuditLog -Filter "description -eq 'Added property (test.updated'"

[aggie87]

I think it depends on whether you are able to enter something that ends on a word boundary. If you truncate the search at the test. does it still work?

My search replaces test.update with ips and it doesn't work still. If I search for (system. it doesn't return anything but if i search (system.categories i get responses. But (system.cat also returns nothing.

[stevevillardi]

still seems to work with Added property (test.. Ill keep testing with some different portals mine is on a newer version so let me try with another one.

[aggie87]

got side tracked but will be looking more detail into that later. i believe my initial tests didn't show meaningful results in the search. I'll try to post some examples soon.