• State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 4 replies
  • Subscribers 94 subscribers
  • Views 2664 views
  • Users 0 members are here
Options
Related

Log Current Value with DialogWatchProperty

dan
over 4 years ago

Using v8.1.1. I've got Splunk that wants to consume the historical data of One Identity. I've got a bunch of watched properties and they're logging into DialogWatchProperty and DialogWatchOperation but my problem is that the current value of an attribute isn't stored in DialogWatchProperty when a change is made, only the old value. This means I have to do something custom for the Splunk agent to get the data it wants. Any ideas about approach to doing this?

Parents Reply Children
  • +1 over 4 years ago in reply to dan

    Hi Dan,

    Historical assignments will give you data about assignments. If you are looking at simple object changes there is another query module for that. See the report VI_Person_Overview_With_History for an example.

    DialogWatchProperty does not store the current value of a field as that would be very inefficient.

    If you can use the object layer, I would recommend using the IHistorySource interface something like this:

    ISession session = <database session>
    IDbObjectKey key = <key of your object>
    var changes = session.Resolve<VI.DB.History.IHistorySource>().GetChanges(key, DateTime.MinValue, VI.DB.History.HistoryMode.Default).Result;