1

I can see query_results table stores list of all the queries being executed in Redash. I have 2 questions

  • Is there any way in which I can find out which user has executed the query. I can see org_id but userid is missing. If we do not have can we add that support?
  • I think there is some mismatch in data, I can see count of queries in 10K for last 7 days and before that, it is in 2 digits. Do we clean up the ad-hoc query data from query results?

Why do we need:

  • We want to audit what kind of queries user is running.
  • Are we leaking any potential critical data to an unauthorized user.
1 Like
2

I think I figured it out. Please validate

SELECT u.name,
e.created_at,
additional_properties,
object_type,
object_id
FROM EVENTS e
join users u on e.user_id = u.id
WHERE action = ‘execute_query’
ORDER BY e.id DESC
LIMIT 100

1 Like
3

The query you posted does in fact work.