Hi Rajiv,

This is Ovidiu with Okta Support team! In order to search the System log for application update events, you need to use this query:

eventType eq "application.lifecycle.update"

This will list all the events with all the applications that were modified. The actorid will specify the administrator who performed the changes, and if you need to check for a specific application, you need to add this variable to the query:

target.id eq "{id of the application}"

so the final query would look like this:

eventType eq "application.lifecycle.update" and target.id eq "{id of the application}"

you can then add the administrator that you wish to check to the query and the result would be:

eventType eq "application.lifecycle.update" and target.id eq "{id of the application}" and actor.id eq "{administrator user Id}"

I hope this helps you, but if you need additional assistance or have other questions, you can also open a Support ticket and we will do our best to help you!