This article describes how to search for deleted users in the system logs.

• Deleted Users
• System Logs

Please follow the steps below to search for deleted users in the system logs:

1. From the Okta admin console, go to: Reports > System Logs.

2. Enter the date range to search for: (Our logs only go as far back as 3 months).

3. In the system logs, there are 2 ways to search for queries:

   1. Search Bar

      1. In the search bar, enter: eventType eq "user.lifecycle.delete.initiated".

      2. Press the magnifying glass button (search button).

      3. Below is a sample of the search results for the deleted users:
         
          

      4. If clicking on the Expand all. The eventType: "user.lifecycle.deleted.initiated" will be seen. This is the "filter field" that is used in the search bar.
          

   2. Advance filter

      1. Click on the Advanced Filter link right below the right side of the search bar.

      2. An Advanced Search box will show:
          

      3. Please enter the following:

         • "Enter a field to filter by": eventType

         • "Enter filter value": user.lifecycle.deleted

      4. Apply Filter
          

      5. The search results above will give the same results as the Search Bar.

      6. The Advanced Search is capable of assisting the admin in finding certain search strings that are available to use as they are pre-populated. 

      7. When clicking Add Filter, additional search strings can be added to narrow down the search.