The underlying full data download is not a monitored event.  There is a Tableau Idea here  -  https://community.tableau.com/ideas/6692  that I suggest voting on.  I found an older thread on this topic - Monitoring Tableau Server Full Data Download  as well that may be helpful.

Patrick

I know nothing about this so I ran a test and here's what I found out...

The http_req table is the one where the information can be found.

You want to look in the ACTION column where the value is "vud".

The CURRENTSHEET column is the workbook/sheet name in the database format, not in the human-readable format!  For example, I used the workbook "tabbed admin views" and the sheet "Traffic to Views", thus the CURRENTSHEET value for me was "tabbedadminviews/TraffictoViews".

The column HTTP_REQUEST_URI tells you the request made and it's the last values that tell you if it's a summary or detail download:

    ~ if the field ends with "csv=true&summary=true" then the user downloaded the data in summary form

    ~ if the field ends with "csv=true" then the user downloaded the data in detailed form.

Here's what it looks like when I filtered the data for today only and only looking at my IP address (filtered on REMOTE_IP):

Read from the bottom and work your way up.

(1) is the call for Summary download

(2) is the call for Detailed download

You want to know the SITE_ID so you don't get workbooks confused if you have more than one Site.  However, this isn't a guarantee that you'll know the exact workbook if Users duplicate workbook and/or sheet names (this is NOT uncommon ) so you can parse the HTTP_REFERER field to pull out that data.  Here's an example of that column from my data:

If you study the data in the field you'll find:

     ~ the Site: /t/area51

     ~ the Workbook: /w/tabbedadminviews

     ~ the Sheet (a.k.a. View): /v/TraffictoViews

This is the hard part and will get you started.  This is not a guarantee that this is 100% accurate and it has not been thoroughly vetted.

Thank you for the detailed investigation Toby.  A remarkable Ambassador!!!  

Patrick

Just a short follow-up (reading from the bottom up):  I opened a workbook, went to a sheet, downloaded it as a PDF (opened in Adobe Reader) and then immediately downloaded it as a Tableau workbook (opened in Tableau Desktop).  This shows what the ACTION, CONTROLLER, and HTTP_REQUEST_URI fields look like.

(1) Downloading a viz as a PDF.

(2) Downloading a viz as a Tableau workbook.

Hi Toby,

Could you please provide SQL query to get the detail table to track users details who are requested for downloading data i just want to track this info.

i just want to create a report on tracking  user cations on downloading data

I have tried to join _http_req to _user Table   based n user id in  _HTTTP_REQ and ID column is in _User

i have trouble getting these table together to show which user requested for the Cross data download, CSV file to a server and want to identify his name, id and time

Thanks

This can get you started:

SELECT  http.*, use.*, sys.*
FROM    public.http_requests http
        LEFT OUTER JOIN public.users use ON http.user_id=use.id,
        public.system_users sys
WHERE    use.system_user_id=sys.id
AND      http.controller like '%cross%'

Hi

Is there anyway of finding this out on Tableau Online?

Thanks

Paul

This is ace thanks. I put wildcard searches in for HTTP_REQUEST_URI contains "%csv=true%", "%maxrows%" and action - "vud", created a date filter. Used the [Current Sheet] column to name the workbook. Thanks so much, very helpful.