Looker events

This page describes the events that Looker generates and how to view them.

Viewing events

Looker events are visible in theSystem ActivityEvent andEvent Attribute Explores. You must be a Looker admin or have thesee_system_activity permission to view theEvent andEvent Attribute Explores.

If you have enabled theSystem Activity ModelLabs feature, you will see the list of System Activity Explores, including theEvent andEvent Attribute Explores, at the bottom of your Explore menu.

TheEvent Explore includes theEvent view, which includes categories, created dates and times, and names of each event created.

TheEvent Attribute Explore includes both theEvent view and theEvent Attribute view. TheEvent Attribute view shows the name and value of each attribute related to an individual event.

Common event attributes

Each Looker-generated event includes a set of data about the event. These common attributes are:

Attribute nameDescription
idUnique numeric identifier of the event
user_idUnique numeric ID of the user who triggered the event
nameName of the specific event that occurred, for example,create_dashboard
createdDate and time, in UTC, that the event was created
categoryHigh-level category associated with the event, for example,dashboard
sudo_user_idUnique numeric ID of the actual user who is impersonating the user indicated byuser_id
is_looker_employeeWhether the user identified byuser_id is a Looker employee
is_adminWhether the user identified byuser_id is a Looker admin
is_api_callWhether the event was caused by an API call

List of event types

The following table lists several events that can be generated by a Looker server.

This list includes the name of the event, the action or situation that can trigger the generation of the event, and a list of attributes associated with each event.

Event typeTriggerAttributes
accept_integration_hub_legal_agreementA user accepted the legal agreement for a custom Action Hub server.none
account_manually_unlockedA login lockout was removed for a user.
  • key: key of the user
  • user_id: ID of the user
  • acquire_cookieless_embed_sessionA cookieless embed session was initiated.none
    activate_oauth_client_app_userA user was activated on an OAuth app client, usually by accepting the terms and permissions of the app.
  • app_client_guid: ID of the app
  • app_display_name: User-friendly display name of the app
  • ip: IP address of the request
  • user_id: ID of the activated user
  • add_external_email_to_scheduled_taskAn email outside the organization domain was added to a scheduled task.
  • scheduled_task_id: ID of the scheduled task
  • external email: email that was added
  • add_group_groupA group was added as a member of another group.
  • parent_group_id: ID of the parent group
  • adding_group_id: ID of the added group
  • deleting_group_id: ID of the deleted group
  • add_group_userA user was added to a group.
  • group_id: ID of the group
  • user_id: ID of the user
  • add_user_to_scheduled_taskA user was added to a scheduled task.
  • scheduled_task_id: ID of the scheduled task
  • user_id: ID of the added user
  • alert_options_v0A user selected the alert button on a dashboard tile.
  • duration: time taken for Looker to load the alert options for the dashboard tile, in seconds
  • success: whether Looker successfully loaded alert options for the dashboard tile
  • async_query_executionA query was sent to a database (not retrieved from Looker cache).
  • eager_poll: Whether the query was initiated with eager polling. Eager polling is when Looker keeps the connection to the database open while the query runs, rather than waiting for the database to notify Looker that the query is complete. It improves performance for fast queries.
  • copy_dashboardA dashboard was copied.
  • dashboard_id: ID of the dashboard
  • folder_id: ID of the destination folder
  • copy_lookA Look was copied.
  • look_id: ID of the Look
  • folder_id: ID of the destination folder
  • create_agentA Conversational Analytics user created a data agent.none
    create_alertA user created an alert.
  • alert_id: ID of the alert
  • channel_destinations: number of Slack channels that this alert will post in
  • cron: cron string that defines when the alert is checked
  • duration: time taken for Looker to create the alert, in seconds
  • email_destinations: number of email addresses that this alert will send to
  • embed_user: whether this alert was created by an embedded user
  • followable: whether this alert is followable
  • public: whether this alert is public
  • success whether this alert was successfully created
  • total_destinations: total number of destinations, including Slack channels and email addresses, that this alert will send to
  • vis_type: visualization type of the alert's query
  • create_color_collectionA custom color collection was created.collection_id: ID of the color connection
    create_connectionA user created a connection.
  • connection_id: numeric ID of the connection
  • database: name of the database used in the connection
  • dialect: database dialect used in the connection
  • name: name of the connection
  • create_content_metadata_accessA user applied content access settings for a board, Look, dashboard, or folder.
  • content_metadata_id: ID of the content metadata
  • group_id: ID of the group that the settings apply to
  • user_id: ID of the user that the settings apply to
  • permission_type: type of content access (view or edit)
  • content_type: type of the content (board, Look, dashboard, or folder)
  • send_boards_notification_email: whether an email notification should be sent to groups and users who can access a board
  • create_conversationA Conversational Analytics user created a new conversation.none
    create_conversation_messageA Conversational Analytics user asked a question in a conversation.count: number of messages in a conversation
    create_dashboardA new dashboard object was created.dashboard_id: ID of the dashboard
    create_dashboard_elementA dashboard tile was created on a dashboard.dashboard_element_id: ID of the dashboard tile
    create_dashboard_element_render_taskA new task was created to render a dashboard tile to an image.
  • render_task_id: ID of the render task
  • dashboard_element_id: ID of the dashboard tile to be rendered
  • format: resulting format of the rendered dashboard tile
  • create_dashboard_filterA dashboard filter was created on a dashboard.dashboard_filter_id: ID of the dashboard filter
    create_dashboard_layoutA dashboard layout was created.dashboard_layout_id: ID of the dashboard layout
    create_dashboard_render_taskA new task was created to render a dashboard to a document or an image.
  • render_task_id: ID of the render task
  • dashboard_id: ID of the dashboard to be rendered
  • lookml_dashboard: whether the dashboard is a LookML dashboard
  • target_type: resulting format of the rendered dashboard
  • create_embed_token_urlAn embed URL was created.prefix: prefix of the URL
    create_embed_userAn embedded user was created.user_id: ID of the user
    create_external_oauth_applicationAn external OAuth application was created.
  • oauth_application_id: ID of the OAuth application
  • name: name of the OAuth application
  • dialect_name: name of the database dialect for the OAuth application
  • create_favorite_contentA user marked a Look or dashboard as a favorite.content_favorite_id: unique ID for the favorite object
    create_git_branchA Git branch was created on a LookML project.
  • project_id: ID of the project
  • successful: whether the branch creation was successful
  • create_git_deploy_keyA Git deploy key was created on a LookML project.project_id: ID of the project
    create_groupA group was created.group_id: ID of the group
    create_homepage_itemA new curated homepage item was created.
  • has_title: whether the item has a title
  • has_text: whether the item has text
  • has_link: whether the item has a link
  • has_image: whether the item has an image
  • create_homepage_sectionA new curated homepage section was created.homepage_section_id: ID of the curated section
    create_look_prefetchA prefetch for a Look was created with the specified information.look_id: ID of the Look that had a prefetch created
    create_lookA Look was created or deleted.look_id: ID of the Look
    create_look_render_taskA new task was created to render a Look to an image.
  • render_task_id: ID of the render task
  • look_id: ID of the Look to be rendered
  • format: resulting image format
  • create_lookml_modelA LookML model was created.
  • lookml_model_id: ID of the LookML model
  • name: name of the LookML model
  • project_name: name of the project
  • unlimited_db_connections: whether the model has unlimited database connections
  • allowed_db_connection_names: list of database connection names that are allowed to be used in the model
  • create_merge_queryA merged query was created.merge_query_id: ID of the merge query
    create_oauth_application_user_stateA user state was created for an external OAuth application.
  • oauth_application_id: ID of the OAuth application
  • user_id: ID of the user
  • create_oidc_test_configAn OpenID Connect test configuration was created.has_error: Whether the test configuration has any errors
    create_projectA new LookML project was created.
  • project_id: name of the project
  • creation_type: How the project was created:
  • create_project_fileA new file was created in a project.
  • project: name of the project
  • file: name of the newly created file
  • file_type: type of file created (model, view, etc)
  • create_query_render_taskA new task was created to render an existing query to an image.
  • render_task_id: ID of the render task
  • query_id: ID of the query to be rendered
  • format: resulting image format
  • create_queryA query was created.query_id: ID of the new query
    create_roleA new role was created.
  • role_id: ID of the new role
  • permission_set_id: ID of the role's permission set
  • model_set_id: ID of the role's model set
  • create_saml_test_configA SAML test configuration was created.has_error: whether the SAML config has an error
    create_scheduled_plan_destinationA scheduled plan destination was created.id: ID of the created plan
    create_sso_urlA signed embed URL was created.
  • secret_id: ID of the embed secret for this instance
  • nonce: Nonce value for this URL
  • create_ssh_serverAn SSH server was created.ssh_server_id: ID of the SSH server
    create_ssh_tunnelAn SSH tunnel was created.ssh_server_id: ID of the SSH server
    create_sql_interface_queryA SQL Interface query was created.query_id: ID of the new query
    create_sql_queryA SQL Runner query was created.query_id: ID of the new query
    create_support_access_allowlistA set of email addresses was added to the support access allowlist.none
    create_themeA theme was created.id: ID of the theme
    create_uploadA CSV file for user-defined table generation/load was uploaded.upload_id: ID of the uploaded data
    create_user_access_filterAn access filter was created for the specified user.for_user_id: ID of the user whose access filters were created
    create_user_attributeA user attribute was created.
  • label: Human-friendly label of the user attribute
  • name: name of the user attribute
  • user_attribute_id: ID of the user attribute
  • create_user_credentials_api(Legacy) API login information was created for the specified user. This is forAPI Users used for theold query API.
  • for_user_id: ID of the user whose API credentials were created
  • create_user_credentials_api3API 3 login information was created for the specified user. This is for the newer API keys that can be added for any user.
  • for_user_id: ID of the user whose API 3 credentials were created
  • create_user_credentials_emailEmail/password login information was created for the specified user.
  • for_user_id: ID of the user whose email credentials were created
  • create_user_credentials_email_password_resetA password reset token was created.
  • for_user_id: ID of the user whose password reset token was created
  • create_user_credentials_totpTwo-factor login information was created for the specified user.
  • for_user_id: ID of the user whose TOTP credentials were created
  • create_userA user was created with the specified information.
  • user_id: ID of the user whose account was created
  • reason: (optional) method used to create the user account. Ifreason is missing, an admin created the user account. Otherwise, the account was automatically created as a result of a user action likelogin,license_setup,marketplace_setup, orself_created.
  • type: (optional) credentials type for this user, especially if the user was auto-created at login
  • dashboard.next.renderedA dashboard was rendered as a PDF.
  • dashboard_id: ID of the dashboard
  • load_session_id: unique hash ID of the load session
  • cache_count: number of dashboard queries that were pulled from cache
  • query_count: number of dashboard queries that were run on the database
  • ttr: time to run the dashboard, in milliseconds
  • dashboard.run.data_receivedA dashboard received query results for one of its tiles.
  • load_session_id: unique hash ID of the dashboard load session
  • run_session_id: unique hash ID of the dashboard run session
  • query_task_id: ID of the query task that was run asynchronously for this dashboard
  • dashboard.run.data_renderedA dashboard rendered a visualization for one of its tiles.
  • load_session_id: unique hash ID of the dashboard load session
  • run_session_id: unique hash ID of the dashboard run session
  • query_task_id: ID of the query task that was run asynchronously for this dashboard
  • vis_type: visualization type of the dashboard tile.
  • dashboard.run.startA dashboard was run.
  • cache_run: whether the user selectedClear cache and refresh
  • load_session_id: unique hash ID of the load session
  • run_session_id: unique hash ID of the run session
  • datagroup_trigger_changedA datagroup trigger was changed.
  • runtime: total time to run the trigger
  • connection_id: ID of the connection
  • connection_name: name of the connection
  • dialect: dialect of the connection
  • name: name of the datagroup
  • deactivate_oauth_client_app_userA user was deactived from an OAuth app client.
  • app_client_guid: ID of the app
  • app_display_name: User-friendly display name of the app
  • ip: IP address of the request
  • user_id: ID of the deactivated user
  • delete_alertAn alert was deleted from a dashboard tile.
  • duration: time taken for Looker to delete the alert, in seconds
  • success: whether Looker successfully deleted the alert
  • delete_color_collectionA custom color collection was deleted.
  • id: ID of the color collection
  • delete_connectionA connection was deleted.
  • connection_id: numeric ID of the connection
  • database: name of the database used in the connection
  • name: name of the connection
  • delete_connection_overrideA connection override was deleted.
  • connection_id: numeric ID of the connection
  • database: name of the database used in the connection
  • name: name of the connection
  • context: context of connection override
  • delete_content_metadata_accessA user removed content access settings for a board, Look, dashboard, or folder.
  • content_metadata_id: ID of the content metadata
  • group_id: ID of the group that the settings apply to
  • user_id: ID of the user that the settings apply to
  • permission_type: type of content access (view or edit)
  • content_type: type of the content (board, Look, dashboard, or folder)
  • send_boards_notification_email: whether an email notification should be sent to groups and users who can access a board
  • delete_conversationA Conversational Analytics user deleted a conversation.none
    delete_conversation_messageA Conversational Analytics user deleted the most recent question-answer pair.none
    delete_cookieless_embed_sessionA cookieless embed session was deleted.session_reference_token: Reference token of the deleted session
    delete_dashboardA dashboard was permanently deleted.dashboard_id: ID of the deleted dashboard
    delete_dashboard_elementA dashboard tile was deleted from a dashboard.dashboard_element_id: ID of the dashboard tile
    delete_dashboard_filterA dashboard filter was deleted from a dashboard.dashboard_filter_id: ID of the dashboard filter
    delete_dashboard_layoutA dashboard layout was deleted.dashboard_layout_id: ID of the dashboard layout
    delete_favorite_contentA user unmarked a Look or dashboard as a favorite.content_favorite_id: unique ID for the favorite object
    delete_folderA folder was removed.none
    delete_git_branchA Git branch was deleted on a LookML project.
  • project_id: ID of the project
  • successful: whether the branch delete was successful
  • error_code: error code returned by the deletion process
  • delete_groupA group was deleted.group_id: ID of the group
    delete_group_from_groupA group was deleted as a member of another group.
  • parent_group_id: ID of the parent group
  • adding_group_id: ID of the added group
  • deleting_group_id: ID of the deleted group
  • delete_group_userA user was removed from a group.
  • group_id: ID of the group
  • user_id: ID of the user who was removed from the group
  • delete_homepage_itemA homepage item was deleted.homepage_item_id: ID of the deleted homepage item
    delete_homepage_sectionA homepage section was deleted.homepage_section_id: ID of the deleted homepage section
    delete_integration_hubA custom Action Hub server was deleted.integration_hub_id: ID of the Action Hub
    delete_lookA Look was deleted.look_id: ID of the deleted Look
    delete_lookml_modelA LookML model was deleted.
  • lookml_model_id: ID of the LookML model
  • name: name of the LookML model
  • project_name: name of the project
  • unlimited_db_connections: whether the model has unlimiteddatabase connections
  • allowed_db_connection_names: list of database connection namesthat are allowed to be used in the model
  • delete_mobile_device_registrationA mobile device registration was deleted.none
    delete_model_setA model set was deleted.model_set_id: ID of the deleted model set
    delete_oauth_client_appAn OAuth app client was deleted.
  • app_client_guid: ID of the app
  • app_display_name: User-friendly display name of the app
  • ip: IP address of the request
  • user_id: ID of the user who made the request
  • delete_oidc_test_configAn OpenID Connect test configuration was deleted.none
    delete_permission_setA permission set was deleted.permission_set_id: ID of the deleted permission set
    delete_projectA LookML project was deleted.project_id: name of the project
    delete_project_fileA file was deleted in a project.
  • project: name of the project
  • file: name of the deleted file
  • file_type: type of file deleted (model, view, etc)
  • delete_repository_credentialA Git repository credential was deleted.
  • root_project_ID: ID of the repository
  • remote_url: URL of the repository
  • credential_id: ID of the deleted credential
  • existed: whether the credential existed
  • delete_roleA role was deleted.role_id: ID of the deleted role
    delete_saml_test_configA SAML test configuration was deleted.none
    delete_scheduled_planA scheduled plan was deleted.id: ID of the deleted scheduled plan
    delete_scheduled_plan_destinationA scheduled plan destination was deleted.id: ID of the deleted scheduled plan destination
    delete_ssh_serverAn SSH server was deleted.ssh_server_id: ID of the SSH server
    delete_ssh_tunnelAn SSH tunnel was deleted.ssh_server_id: ID of the SSH server
    delete_spaceA folder was removed.none
    delete_support_access_allowlistA set of email addresses was removed from the support access allowlist.none
    delete_themeA theme was deleted.id: ID of the theme
    delete_uploadAn uploaded table with a specific ID was dropped.upload_id: ID of the table
    delete_user_access_filterAn access filter for the specified user was deleted.for_user_id: ID of the user whose access filters were deleted
    delete_user_attributeA user attribute was deleted.user_attribute_id: ID of the user attribute
    delete_user_attribute_group_valueA user attribute value was removed from a group.
  • group_id: ID of the group
  • user_attribute_name: name of the user attribute
  • user_attribute_id: ID of the user attribute
  • delete_user_attribute_user_valueA user attribute value was deleted for a user.
  • user_attribute_name: name of the user attribute
  • user_attribute_id: ID of the user attribute
  • user_id: ID of the user
  • delete_user_credentials_api(Legacy) API login information for the specified user was deleted. This is forAPI Users used for theold query API.
  • for_user_id: ID of the user whose API credentials were deleted
  • delete_user_credentials_api3API 3 login information for the specified user was deleted. This is for the newer API keys that can be added for any user.
  • for_user_id: ID of the user whose API 3 credentials were deleted
  • delete_user_credentials_emailEmail/password login information for the specified user was deleted.
  • for_user_id: ID of the user whose email credentials were deleted
  • delete_user_credentials_embedEmbed login information for the specified user was deleted.
  • for_user_id: ID of the user whose Embed credentials were deleted
  • delete_user_credentials_googleGoogle authentication login information for the specified user was deleted.
  • for_user_id: ID of the user whose Google credentials were deleted
  • delete_user_credentials_ldapLDAP login information for the specified user was deleted.
  • for_user_id: ID of the user whose LDAP credentials were deleted
  • delete_user_credentials_looker_openidLooker OpenID login information for the specified user was deleted. Used by Looker analysts.
  • for_user_id: ID of the user whose Looker OpenID credentials were deleted
  • delete_user_credentials_samlSAML authentication login information for the specified user was deleted.
  • for_user_id: ID of the user whose SAML credentials were deleted
  • delete_user_credentials_totpTwo-factor login information for the specified user was deleted.
  • for_user_id: ID of the user whose TOTP credentials were deleted
  • delete_user_sessionA web login session for the specified user was deleted.
  • for_user_id: ID of the user whose session was deleted
  • delete_userA user was deleted.user_id: ID of the user whose account was deleted
    deploy_to_productionA user's dev branch was deployed to production.
  • project_id: ID of the project
  • success: Whether or not the deploy was successful
  • deploy_ref_to_productionA Git branch or reference was deployed to production.
  • project: ID of the project
  • used_branch: Branch that was deployed to production
  • used_ref: Reference that was deployed to production
  • successful: Whether or not the deploy was successful
  • detect_alert_driftBefore running analert, Looker checks to see if the underlying dashboard tile has changed.
  • alert_condition_base_query_id: query ID of the dashboard tile. Usually matchesdashboard_element_query_id
  • alert_condition_condition_query_id: query ID of the alert condition
  • alert_condition_id: ID of the alert condition. Usually matches thealert_id
  • alert_id: unique ID of the alert
  • dashboard_element_id: dashboard element ID of the underlying dashboard tile
  • dashboard_element_query_id: query ID of the dashboard tile
  • dashboard_type: type of dashboard (user defined dashboard or LookML dashboard)
  • suspected_reason: change to the dashboard element. If no changes are detected, the value will beno_drift
  • sync_classification: A detailed list of all changes made to the dashboard element
  • sync_type: Whether the change to the dashboard element is likely to cause disruption to the alert. If no changes are detected, the value will be null
  • digest_email_sendA message was added to the digest email feed. This event does not trigger email delivery.
  • success: Whether the message was successfully added to the feed
  • message: message that was added to the feed
  • disable_oidc_configOpenID Connect authentication was disabled for the instance.none
    disable_saml_configSAML authentication was disabled for the instance.none
    disable_userA user account was disabled.user_id: ID of the user whose account was disabled
    embed_cookieless_v2Cookieless embed was toggled on or off.embed_cookieless_v2: whether cookieless embed was enabled or disabled
    enable_oidc_configOpenID Connect authentication was enabled for the instance.none
    enable_saml_configSAML authentication was enabled for the instance.none
    enable_userA user account was enabled.user_id: ID of the user whose account was enabled
    enter_sudoA user enteredsudo (impersonation) as another user in the UI.
  • target_user_id: ID of the target user
  • session_id: ID of the Looker session
  • exit_sudoA user exitedsudo (impersonation) as another user in the UI.
  • target_user_id: ID of the target user
  • session_id: ID of the Looker session
  • export_queryA user downloaded a file in a format other than PNG or PDF
  • dialect: Database dialect of the query
  • export_format: format of the download (CSV, JSON, etc)
  • history_id: History ID of the query
  • query_params: Query parameters that describe the query
  • source: source from which the download originated (API, drill modal, etc)
  • fetch_and_parse_saml_idp_metadataThe given URL was fetched and parsed as a SAML IdP metadata document, and the result was returned.none
    fetch_dashboardA dashboard's properties were retrieved.dashboard_id: ID of the dashboard
    fetch_integration_formThe form for an Action was retrieved.none
    fetch_remote_data_action_formA data action requested further information from a user before completing.none
    find_and_replaceThe find and replace function of the Content Validator was used.
  • replace_type: type of replacement.field,view,model, orexplore
  • error_count: number of errors, if any
  • look_ids: IDs of Looks that were successfully updated, if any
  • follow_alertA user followed an alert.
  • alert_id: ID of the alert
  • channel_destinations: number of Slack channels that this alert will post in
  • cron: cron string that defines when the alert is checked
  • duration: time taken for Looker to follow the alert, in seconds
  • email_destinations: number of email addresses that this alert will send to
  • embed_user: whether this alert was followed by an embedded user
  • followable: whether this alert is followable
  • public: whether this alert is public
  • success whether this alert was successfully followed
  • total_destinations: total number of destinations, including Slack channels and email addresses, that this alert will send to
  • vis_type: visualization type of the alert's query
  • force_password_reset_at_next_login_for_all_usersAll users with passwords were forced to reset their passwords upon their next login.none
    generate_tokens_for_cookieless_sessionAPI and navigation tokens for a cookieless embed session were generated.none
    generating_mail_dashboardA dashboard was rendered as an email.
  • source_url: source URL of the dashboard
  • items: number of dashboard elements rendered
  • generating_pdfA dashboard was rendered as a PDF.
  • source_url: source URL of the dashboard
  • items: number of dashboard elements rendered
  • get_agentA Conversational Analytics user navigated directly to a data agent.none
    get_alerts_v0A user selected the alert button on a tile, and Looker computed the number of alerts already on that tile.
  • duration: time taken for Looker to compute the number of alerts on the tile, in seconds
  • count: number of alerts on the tile
  • success: whether Looker successfully computed the number of alerts on the tile
  • get_conversationA Conversational Analytics user opened an existing conversation.none
    get_egress_ip_addressesThe egress IP addresses for the instance were retrieved.none
    get_folder_childrenThe list of subfolders for a folder was retrieved.
  • folder_id: ID of the folder
  • children_count: number of children in the folder
  • elapsed_seconds: time taken in seconds to retrieve the children
  • get_integrationInformation about an Action was retrieved.integration_type: type of integration
    get_mobile_settingsThe mobile settings for the instance were retrieved.none
    get_oauth_client_appThe settings for an OAuth app client were returned.
  • app_client_guid: ID of the app
  • app_display_name: User-friendly display name of the app
  • ip: IP address of the request
  • user_id: ID of the user who made the request
  • get_scheduled_plansA list of scheduled plans for all content in a folder was retrieved.
  • folder_id: ID of the folder
  • scheduled_plan_count: number of scheduled plans in the folder
  • elapsed_seconds: time taken in seconds to retrieve the scheduled plans
  • get_support_access_allowlistThe list of email addresses in the support access allowlist was retrieved.none
    import_lookml_dashboardA user-defined dashboard has been created from a LookML dashboard.
  • lookml_dashboard_id: ID of the LookML dashboard
  • space_id: ID of the space where the user-defined dashboard was created
  • integration_disabledAn Action was disabled.integration_name: name of the integration
    integration_enabledAn Action was enabled.integration_name: name of the integration
    invalidate_oauth_client_app_tokensAll sessions, access tokens and refresh tokens for this app were deleted.
  • app_client_guid: ID of the app
  • app_display_name: User-friendly display name of the app
  • ip: IP address of the request
  • user_id: ID of the user who made the request
  • kill_queryA query was stopped from running.query_task_id: ID of the query task
    list_oauth_client_appsA list of applications registered to use OAuth2 login with this Looker instance was returned.
  • ip: IP address of the request
  • user_id: ID of the user who made the request
  • lock_allA lockfile was created on a LookML project.
  • project_id: ID of the project
  • successful: Whether or not the lockfile was created successfully
  • loginA user logged in to the UI or API.
  • type: type of authentication system
  • ldap: whether the login occurred through the LDAP protocol
  • ip: IP address of the request
  • user_id: ID of the user who logged in
  • login_failureA user's login attempt to the UI or API failed.
  • type: type of authentication system
  • ip: IP address of the request
  • user_id_offered: user identifier string that the user offered in the attempt (as appropriate for the different auth systems)
  • msg: details string about the attempt processing
  • login_userAn API session was transformed to impersonate a user. This is often used when a service account is configured to enable API calls on behalf of users without needing to provision API credentials for individual users.
  • target_user_id: ID of the target user
  • token_id: ID of the session token for this API session
  • lookml_dashboard_metadata_savedLooker performed a periodic check on the state of LookML dashboards on the instance.
  • added_dashboard_count: number of LookML dashboards that were created since the last check
  • deleted_dashboard_count: number of LookML dashboards that were deleted since the last check
  • updated_dashboard_count: number of LookML dashboards that were updated since the last check
  • mail_openedAn email was opened.
  • mail_type:password reset orscheduled task, for example
  • recipient: hash of the recipient's email address
  • build_time: time at which the MailJob was created
  • look_id: ID of the Look (if a Look email is scheduled); otherwise, null
  • dashboard_id: ID of the dashboard (if a dashboard email is scheduled); otherwise, null
  • scheduled_task_id: ID of the scheduled task (if a task email is scheduled); otherwise, null
  • mail_sentAn email was sent by the mailer.
  • mail_type:password reset orscheduled task, for example
  • recipient: hash of the recipient's email address
  • look_id: ID of the Look (if a Look email is scheduled); otherwise, null
  • dashboard_id: ID of the dashboard (if a dashboard email is scheduled); otherwise, null
  • scheduled_task_id: ID of the scheduled task (if a task email is scheduled); otherwise, null
  • move_dashboardA dashboard was moved to another folder.
  • dashboard_id: ID of the dashboard
  • folder_id: ID of the destination folder
  • move_folderA folder was moved or renamed.
  • origin_space_id: ID of the original parent folder
  • destination_space_id: ID of the new parent folder
  • move_lookA Look was moved to another folder.
  • look_id: ID of the Look
  • folder_id: ID of the destination folder
  • move_spaceA folder was moved or renamed.
  • origin_space_id: ID of the original parent
  • destination_space_id: ID of the new parent
  • new_folderA folder was created.has_parent: whether the folder has a parent folder
    new_model_setA model set was created.
  • model_set_id: ID of the new model set
  • models: JSON object containing the models
  • new_permission_setA permission set was created.
  • permission_set_id: ID of the new permission set
  • permissions: JSON object containing the permissions
  • new_spaceA folder was added.has_parent: whether the folder has a parent folder
    oauth_client_app_user_authenticationAn application attempted to authenticate to the Looker instance.
  • oauth_client_app_guid : unique ID that the app identifies itself with
  • type: type of authentication that the app used. Most oftenapi
  • user_id: Looker user ID that the app authenticated as
  • parse_saml_idp_metadataThe given XML was parsed as a SAML IdP metadata document, and the result was returned.none
    password_last_changedThe last time a user changed their login password.none
    password_expired_resetA user reset their login password after it expired.none
    password_near_expiry_resetA user reset their login password when it was set to expire within the next 1 to 14 days.none
    perform_data_actionA data action was initiated.none
    purge_artifactsA Looker-built extension purged its artifacts.none
    redirect_queryA new query was mapped to an existing query.
  • look_id: ID of the Look for this query
  • model: name of the model for this query
  • view: name of the view for this query
  • register_mobile_deviceA mobile device was registered to the instance.none
    register_oauth_client_appAn OAuth app client was created.
  • app_client_guid: ID of the app
  • app_display_name: User-friendly display name of the app
  • ip: IP address of the request
  • user_id: ID of the user who made the request
  • render_scheduled_dashboardA scheduled dashboard was rendered.
  • target_uri: URI of the dashboard to be rendered
  • type: rendered file type
  • render_scheduled_lookA scheduled Look was rendered.
  • target_uri: URI of the Look to be rendered
  • type: rendered file type
  • dimensions: dimensionsof the rendered image
  • render_timeout_for_scheduled_dashboardA timeout occurred while a scheduled dashboard was being rendered.
  • target_uri: URI of the dashboard that was rendered
  • type: rendered file type
  • render_timeout_for_scheduled_lookA timeout occurred while a scheduled Look was being rendered.
  • target_uri: URI of the Look that was rendered
  • type: rendered file type
  • dimensions: dimensions of the rendered image
  • reset_passwordAn admin triggered a password reset for a user.none
    reset_to_productionA LookML project was reset to its production status.
  • project_id: ID of the project
  • success: Whether or not the reset was successful
  • reset_to_remoteA LookML project was reset to its remote status.
  • project_id: ID of the project
  • success: Whether or not the reset was successful
  • run_alertAn alert's condition was checked.
  • alert_id: ID of the alert
  • condition_met: whetherthe alert's conditions were met
  • cron: cron string that defineswhen the alert is checked
  • elapsed_time: total amount of timetaken for Looker to check the alert condition, in seconds.This includes query runtime and initialization
  • embed_user: whetherthis alert was created by an embedded user
  • followable: whetherthis alert is followable
  • init_duration: time taken forLooker to initialize the alert condition check, inseconds
  • public: whether this alert is public
  • runtime:time taken for Looker to run the alert's query, inseconds
  • success whether this alert condition was successfullychecked
  • vis_type: visualization type of the alert's query
  • run_inline_query_v2An inline query was run.
  • query_id: ID of the query
  • run_queryA query was completed through the Query Manager.
  • model: model used
  • view: view in model
  • query: query string stored in the history entry
  • history_id: ID of the history entry
  • runtime: runtime up to completion, error, or kill
  • status:completed,killed, orerror
  • uri_length: length of the query string passed inquery
  • dialect: dialect of the database for this query
  • dashboard_id: ID of the UDD dashboard or the name of theLookML dashboard
  • look_id: ID of the Look for this query
  • run_query_taskA saved query was run asynchronously.query_task_id: ID of the query task to run asynchronously
    run_scheduled_taskA scheduled task was run.
  • scheduled_task_id: ID of the scheduled task
  • sent: whether the results were sent (published)
  • run_sql_queryA SQL query was run from SQL Runner.
  • slug: slug of the query
  • user_id: user who ran the query
  • last_runtime: how long the query took the last time itexecuted
  • run_count: how many times the query has been executed
  • dialect: dialect of the query
  • save_content_metadataA user moved a board, Look, dashboard, or folder.
  • content_metadata_id: ID of the content metadata
  • content_type: type of the content (board, Look, dashboard, orfolder)
  • inherits: whether the content inherits access levels from aparent
  • save_content_metadata_accessA user changed content access settings for a board, Look, dashboard, orfolder.
  • content_metadata_id: ID of the content metadata
  • group_id: ID of the group that the settings apply to
  • user_id: ID of the user that the settings apply to
  • permission_type: type of content access (view or edit)
  • content_type: type of the content (board, Look, dashboard, orfolder)
  • save_lookA Look was saved.
  • look_id: ID of the Look
  • vis_type: vis type of the query
  • keep_exploring: user did not immediately view the new Look
  • save_project_fileA file was saved in a project.
  • project: name of the project
  • file: name of the saved file
  • file_type: type of file saved (model, view, etc.)
  • scheduler_deliverThe scheduler delivered a scheduled job.
  • dashboard_id: numeric ID of the dashboard. Null if scheduledcontent is not a user-defined dashboard.
  • enabled: whether this schedule is enabled.
  • lookml_dashboard_id: textual ID of the LookML dashboard. Nullif the scheduled content is not a LookML dashboard.
  • scheduled_job_tracking_id: tracking ID for the scheduledjob.
  • backlog_when_dequeued: number of schedules in the schedulerqueue when this schedule ran.
  • backlog_when_enqueued: number of schedules in the schedulerqueue when this schedule entered the queue.
  • crontab: frequency at which the schedule should be checked.Presented in cron format.
  • destination_count: number of destinations that this scheduleshould be sent to.
  • started_at: time at which the schedule job started
  • seconds_in_queue: number of seconds that this schedule spentin the queue.
  • completed_at: time at which the schedule was sent
  • look_id: numeric ID of the Look. Null if scheduled content isnot a Look.
  • scheduled_plan_id: numeric ID of this scheduled plan.
  • user_id: numeric ID of the user who created this schedule.
  • format: data format that the scheduled content should be sentin.
  • destination_types: a list of destination types that thisschedule should be sent to.
  • status: status of this schedule job
  • require_no_results: whether this schedule requires that noresults are returned in order to send.
  • run_once: whether this scheduled job was triggered by a userselectingRun once orTest on the scheduler modal.
  • require_change: whether this schedule requires that resultschanged from the last run in order to send.
  • require_results: whether this schedule requires that resultsare returned in order to send.
  • timezone: timezone of this schedule'scrontabfrequency.
  • scheduler_executeThe scheduler checked whether a scheduled job should be run.
  • dashboard_id: numeric ID of the dashboard. Null if scheduledcontent is not a user-defined dashboard.
  • enabled: whether this schedule is enabled.
  • lookml_dashboard_id: textual ID of the LookML dashboard. Nullif the scheduled content is not a LookML dashboard.
  • scheduled_job_tracking_id: tracking ID for the scheduledjob. Null if no scheduled job was created during this check.
  • should_deliver: whether a scheduled job should be run duringthis check. For example, if the scheduled content is a Look, and the scheduleis set to run only if there are results, then the scheduled job may not becreated during each check.
  • crontab: frequency at which the schedule should be checked.Presented in cron format.
  • destination_count: number of destinations that this scheduleshould be sent to.
  • started_at: time at which the scheduler check started
  • completed_at: time at which the scheduler check completed
  • look_id: numeric ID of the Look. Null if scheduled content isnot a Look.
  • scheduled_plan_id: numeric ID of this scheduled plan.
  • user_id: numeric ID of the user that created this schedule.
  • format: data format that the scheduled content should be sentin.
  • destination_types: a list of destination types that thisschedule should be sent to.
  • status: status of this schedule check
  • require_no_results: whether this schedule requires that noresults are returned in order to send.
  • run_once: whether this scheduled job was triggered by a userselectingRun once orTest on the scheduler modal.
  • require_change: whether this schedule requires that resultschanged from the last run in order to send.
  • require_results: whether this schedule requires that resultsare returned in order to send.
  • timezone: timezone of this schedule'scrontabfrequency.
  • search_agentsA Conversational Analytics user selected theAgents tab or loadedtheManage agents page.none
    search_alertsA user searched for Alerts.none
    search_conversationsA Conversational Analytics user loaded theRecent page of recentconversations.none
    search_looksA user searched for Looks.
  • folder_id: ID of the folder that the search was performed in(if applicable)
  • look_count: number of Looks returned by the search
  • elapsed_seconds: time in seconds that it took to perform thesearch
  • search_scheduled_plansA user searched for scheduled plans was.
  • all_users: whether the search included results for allusers
  • user_id: ID of the user who initiated the search
  • limit: maximum number of results returned
  • offset: number of results skipped in search
  • sorts: fields sorted by in the search
  • name: scheduled plan name used in the search
  • user_first_name: first name of the user who created thescheduled plan
  • user_last_name: last name of the user who created thescheduled plan
  • recipient: recipient of the scheduled plan
  • destination_type: destination type of the scheduled plan
  • delivery_format: delivery format of the scheduled plan
  • send_user_credentials_email_password_resetA password reset token was sent to a user.for_user_id: ID of the user
    send_test_welcome_emailA test of the custom welcome email was sent.none
    session_config_updatedAn admin updated the Sessions settings.none
    set_default_color_collectionThe global default color collection was set.collection_id: ID of the default color collection
    set_default_themeThe global default theme was set.name: name of the default theme
    set_legacy_feature_#{id}_to_#{val}The legacy feature#{id} was set to#{val} bya user.legacy_feature_id: ID of the legacy feature being altered
    set_settingAn admin updated theGeneral settings.
  • user_id: ID of the user who updated the settings
  • settings: settings that were updated
  • set_smtp_settingsAn admin updated the SMTP settings.success: whether the SMTP settings were successfully updated
    set_user_attribute_group_valuesUser attribute values were updated across a set of groups.
  • user_attribute_name: name of the user attribute
  • user_attribute_id: ID of the user attribute
  • set_user_attribute_user_valueA user attribute value was updated for a user.
  • user_attribute_name: name of the user attribute
  • user_attribute_id: ID of the user attribute
  • user_id: ID of the user
  • start_pdt_buildA PDT was built.
  • source: whether the PDT build was triggered by the PDTregenerator or a query
  • workspace: whether the PDT was built in dev or prod
  • user_id: ID of the user who built the PDT
  • support_access_disabledLooker Support auth access was turned off or toggled byan admin or a privileged developer.
  • support_access_open: false
  • support_access_open_until: time at which the toggle was set tonil
  • support_access_enabledLooker Support auth access was turned on or toggled byan admin or a privileged developer.
  • support_access_open: true
  • support_access_open_until: time at which the toggle wasautomatically set to false
  • sync_lookml_dashboardAll user-defined dashboards linked to a LookML dashboard were updated toreflect changes to the LookML dashboard.
  • lookml_dashboard_id: ID of the LookML dashboard
  • dashboards_synced_count: number of user-defined dashboards thatwere updated
  • test_connectionA connection was tested.
  • dialect: dialect of the connection
  • connection_id: ID of the connection
  • name: name of the connection
  • database: name of the database
  • tests: tests that were run
  • test_connection_configA connection configuration was tested.
  • dialect: dialect of the connection
  • connection_id: ID of the connection
  • name: name of the connection
  • database: name of the database
  • tag_refA tag was created for a user's most recent commit.
  • project: ID of the project
  • success: whether the tag creation was successful
  • test_integrationThe settings for an integration were tested.none
    test_ldap_config_authThe connection authentication settings for an LDAP configuration weretested.success: whether the test was successful
    test_ldap_config_connectionThe connection settings for an LDAP configuration were tested.success: whether the test was successful
    test_user_authThe user authentication settings for an LDAP configuration were tested.success: whether the test was successful
    test_user_infoThe user authentication settings for an LDAP configuration were testedwithout the user being authenticated.success: whether the test was successful
    track_content_viewA user viewed a Look or dashboard.
  • content_id: ID of the Look or dashboard
  • content_type: type of content viewed, most commonlydashboards-next orlooks
  • unchanged_oauth_client_appLooker periodically checks the status of connectors suchasConnected Sheets.
  • app_client_guid: unique ID of the connector
  • app_display_name: user-friendly name of the connector
  • app_enabled: whether the connector is enabled
  • unfollow_alertA user unfollowed an alert.
  • alert_id: ID of the alert
  • channel_destinations: number of Slack channels that thisalert will post in
  • cron: cron string that defines when the alert is checked
  • duration: time taken for Looker to unfollowthe alert, in seconds
  • email_destinations: number of email addresses that thisalert will send to
  • embed_user: whether this alert was unfollowed by an embeddeduser
  • followable: whether this alert is followable
  • public: whether this alert is public
  • success whether this alert was successfully unfollowed
  • total_destinations: total number of destinations, includingSlack channels and email addresses, that this alert will send to
  • vis_type: visualization type of the alert's query
  • update_agentA Conversational Analytics user edited a data agent.none
    update_artifactsA Looker-built extension updated its artifacts.none
    update_cloud_storageThe Cloud Storage configuration was updated.none
    update_color_collectionA user updated a color collection.id: ID of the color collection
    update_conversationA Conversational Analytics user set the title for a conversation.none
    update_custom_welcome_emailThe custom welcome email was updated.
  • enabled: whether the custom welcome email is enabled
  • content: HTML content of the welcome email
  • update_connectionA user updated a connection.
  • connection_id: numeric ID of the connection
  • database: name of the database used in the connection
  • name: name of the connection
  • update_dashboardThe properties of a dashboard were updated.dashboard_id: ID of the dashboard
    update_dashboard_elementA dashboard element was updated.dashboard_element_id: ID of the dashboard element
    update_dashboard_filterA dashboard filter was updated.dashboard_filter_id: ID of the dashboard filter
    update_dashboard_layoutA dashboard layout was updated.dashboard_layout_id: ID of the dashboard layout
    update_dashboard_layout_componentA dashboard layout component was updated.dashboard_layout_component_id: ID of the dashboard layoutcomponent
    update_embed_configThe Embed configuration was updated.
  • old_value: previous auth enabled setting
  • new_value: new auth enabled setting
  • action: whether auth was enabled or disabled
  • domain_whitelist_count: count of allowlist domains
  • update_datagroupThe properties of a datagroup were updated.
  • datagroup_id: ID of the datagroup
  • name: name of the datagroup
  • model_name: name of the model
  • stale_before: time before which the datagroup is consideredstale
  • update_digest_emails_enabledThe email digest settings were updated.enabled: whether email digests are enabled
    update_external_oauth_applicationAn external OAuth application was updated.
  • oauth_application_id: ID of the OAuth application
  • name: name of the OAuth application
  • dialect_name: name of the database dialect for the OAuthapplication
  • update_folderA folder was updated.folder_id: ID of the updated folder
    update_git_branchA Git branch was updated on a LookML project.
  • project_id: ID of the project
  • successful: whether the branch update was successful
  • update_google_configThe Google auth settings were updated.action:enabled,disabled, ormodified
    update_groupA group was updated.group_id: ID of the group
    update_homepage_itemA curated homepage item was updated.
  • homepage_item_id: ID of the updated homepage item
  • has_title: whether the item has a title
  • has_text: whether the item has text
  • has_link: whether the item has a URL
  • has_image: whether the item has an image
  • update_homepage_sectionA curated homepage section (title) was updated.homepage_item_id: ID of the updated homepage item
    update_integrationThe definition for an Action was updated.none
    update_integration_hubThe definition for a custom Action Hub server was updated.integration_hub_id: ID of the Action Hub
    update_internal_help_resourcesThe settings for the internal help resources were updated.enabled: whether the internal help resources are enabled
    update_internal_help_resources_contentThe content for the internal help resources were updated.none
    update_ldap_configThe LDAP auth settings were updated.action:enabled,disabled, ormodified
    update_legacy_featureA legacy feature was toggled on or off.legacy_feature_id: ID of the legacy feature
    update_lookml_modelA LookML model was updated.
  • lookml_model_id: ID of the LookML model
  • name: name of the LookML model
  • project_name: name of the project
  • unlimited_db_connections: whether the model has unlimiteddatabase connections
  • allowed_db_connection_names: list of database connection namesthat are allowed to be used in the model
  • update_mobile_device_registrationA mobile device registration was updated.none
    update_model_setThe models in a model set were changed.
  • model_set_id: ID of the updated model set
  • old_models: JSON object containing the old models
  • update_oidc_configThe OpenID Connect auth settings were updated.action:enabled,disabled, ormodified
    update_oauth_client_appAn OAuth app client was updated.
  • app_client_guid: ID of the app
  • app_display_name: User-friendly display name of the app
  • ip: IP address of the request
  • user_id: ID of the user who made the request
  • update_password_configThe password configuration settings were updated.none
    update_permission_setThe permissions in a permission set were changed.
  • permission_set_id: ID of the updated permission set
  • old_permissions: JSON object containing the old permissions
  • new_permissions: JSON object containing the new permissions
  • update_projectA LookML project was updated.
  • project_id: ID of the project
  • git_release_mgmt_enabled: whetheradvanced deploy mode is enabled for the project.
  • pull_request_mode:Git integration option that is enabled for the project, eitheroff,links,recommended, orrequired
  • update_repository_credentialA Git repository credential was updated.
  • root_project_id: name of the Git repository
  • remote_url: URL for the Git repository
  • update_role_groupsAll groups for a role were set, and all existing group associations fromthat role were removed.
  • role_id: ID of the role
  • group_ids: IDs of groups to set for the role
  • update_role_usersThe set of users with a given role was edited.
  • role_id: ID of the role
  • old_user_ids: JSON object containing the old users with therole
  • new_user_ids: JSON object containing the new users with therole
  • update_roleA role was updated.
  • role_id: ID of the role
  • old_permission_set_id: ID of the role's old permission set
  • old_model_set_id: ID of the role's old model set
  • new_permission_set_id: ID of the role's new permission set
  • new_model_set_id: ID of the role's new model set
  • update_saml_configThe SAML auth settings were updated.action:enabled,disabled, ormodified
    update_scheduled_plan_destinationA scheduled plan destination was updated.id: ID of the updated plan
    update_ssh_serverAn SSH server was updated.ssh_server_id: ID of the SSH server
    update_ssh_tunnelAn SSH tunnel was updated.ssh_server_id: ID of the SSH server
    update_spaceA folder was updated.space_id: ID of the updated folder
    update_themeA theme was updated.id: ID of the theme
    update_totp_configThe two-factor auth settings were updated.action:enabled,disabled, ormodified
    update_uploadThe upload table definition was updated and the DB table wascreated/loaded.upload_id: ID of the uploaded data that was imported to thedatabase
    update_userA user's information was updated.user_id: ID of the modified user
    update_user_access_filterAn access filter was updated for the specified user.for_user_id: ID of the user whose access filters wereupdated
    update_user_attributeThe definition of a user attribute was updated.
  • label: Human-friendly label of the user attribute
  • name: name of the user attribute
  • user_attribute_id: ID of the user attribute
  • update_user_attribute_group_valueA user attribute value was set at the group level.
  • group_id: ID of the group
  • user_attribute_name: name of the user attribute
  • user_attribute_id: ID of the user attribute
  • update_user_credentials_emailEmail/password login information was updated for the specified user.for_user_id: ID of the user whose email credentials wereupdated
    update_user_facts_chunkLooker updated the User Facts table in theUserexplore. The table is updated hourly.
  • chunk_number: ID of the chunk of users about whomLooker computed user facts
  • elapsed_seconds: number of seconds Looker tookto compute user facts
  • facts_created: number of fact entries created
  • facts_deleted: number of fact entries deleted
  • users_processed: number of users processed in this chunk
  • update_whitelabel_configurationThe private label configuration was updated.none
    upload_fileThe contents of file were uploaded to Looker foruser-defined table generation and load.upload_id: ID of the upload that has the custom file attachedto it for later import
    user_permission_elevationA change occurred that caused a user's permissions to be increased insome way.
  • user_id: ID of the user whose permissions changed
  • embed_user: whether this was an Embed user
  • added_permissions: list or permissions that were added
  • old_permissions: list of permissions before the change
  • new_permissions: list of permissions after the change
  • cause: name of the event that caused the change, orunknown if the change can't be attributed to a specific event
  • cause_event_id: ID of the event that caused the change
  • user_roles_updatedA user's roles were edited.
  • user_id: ID of the modified user
  • role_ids: JSON object containing the user's roles
  • validate_compareNew LookML validation was compared to legacy LookML validation for amodel.
  • aragonite_validation_duration_sec: time in seconds that ittook for new LookML validation to complete.
  • aragonite_validation_errors: errors that were found by newLookML validation.
  • legacy_validation_duration_sec: time in seconds that it tookfor legacy LookML validation to complete.
  • legacy_validation_errors: errors that were found by legacyLookML validation.
  • model: name of the model that was validated.
  • summary: a summary of the validation results.
  • validate_themeA theme was validated.name: name of the theme
    wipeout_user_emailsAll email addresses were changed for a disabled user.user_id: ID of the user

    Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

    Last updated 2026-02-19 UTC.