# Why does CloudTrail show "QueryDatabase" events for Quick Sight users without corresponding "GetDashboard" events? **URL:** \ **Category:** Q&A\ **Tags:** qls-event-tracking, qls-monitor-reports, admin, direct-query, user-management, quick-sight\ **Created:** [May 28, 2025, 4:51pm UTC](https://community.amazonquick.com/t/why-does-cloudtrail-show-querydatabase-events-for-quicksight-users-without-corresponding-getdashboard-events/46722 "2025-05-28T16:51:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Dave\_LeBlanc](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/dave_leblanc/32/36851_2.png) [@Dave\_LeBlanc](https://community.amazonquick.com/u/Dave_LeBlanc)\ **Post date:** [May 28, 2025, 4:51pm UTC](https://community.amazonquick.com/t/why-does-cloudtrail-show-querydatabase-events-for-quicksight-users-without-corresponding-getdashboard-events/46722/1 "2025-05-28T16:51:43Z")
Hi all, I’m running into a tracking issue using CloudTrail to monitor Amazon Quick Sight usage. Specifically, when querying CloudTrail event history (via Athena) where `eventSource = 'quicksight.amazonaws.com'`, I’m seeing numerous `QueryDatabase` events attributed to specific users - but **no corresponding `GetDashboard` events** for those same users, even though they report having accessed dashboards during that time. This creates confusion on our end, as we expected a `GetDashboard` event to appear any time a user views a dashboard in the Quick Sight console or via a shared folder. To my knowledge: - `QueryDatabase` suggests that visuals were rendered and queried against the underlying dataset - `GetDashboard` is supposed to log when a dashboard definition is fetched However, the `GetDashboard` events are missing entirely for many sessions. The users are internal registered Quick Sight users (not embedded or anonymous), and dashboards are shared through standard Quick Sight folders. I’ve reviewed the official [Quick Sight + CloudTrail documentation](https://docs.aws.amazon.com/quicksight/latest/user/logging-using-cloudtrail.html) but there’s no mention of this discrepancy. ### My questions: - Under what conditions _should_ a `GetDashboard` event appear in CloudTrail? - Is it expected behavior that `QueryDatabase` events can occur without `GetDashboard`? - Could caching, session reuse, or the type of access (e.g., shared folders) suppress `GetDashboard` logging? - Is there any deeper documentation that clarifies when dashboard views _do_ and _don’t_ trigger CloudTrail events? Any insight from the community or AWS team would be appreciated. Our goal is to build an audit trail of dashboard usage, and right now this inconsistency is making that difficult. Thanks in advance! David ---
**Author:** ![WLS-D](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/wls-d/32/36109_2.png) [@WLS-D](https://community.amazonquick.com/u/WLS-D)\ **Post date:** [May 30, 2025, 3:01pm UTC](https://community.amazonquick.com/t/why-does-cloudtrail-show-querydatabase-events-for-quicksight-users-without-corresponding-getdashboard-events/46722/2 "2025-05-30T15:01:10Z")
Hello @Dave_LeBlanc I’m curious if these are SPICE dataset refreshes and the users that they are attributed to are the owners of the datasets. Do the logs for the `QueryDatabase` look relatively consistent or more random? ---
**Author:** ![Dave\_LeBlanc](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/dave_leblanc/32/36851_2.png) [@Dave\_LeBlanc](https://community.amazonquick.com/u/Dave_LeBlanc)\ **Post date:** [June 2, 2025, 3:31pm UTC](https://community.amazonquick.com/t/why-does-cloudtrail-show-querydatabase-events-for-quicksight-users-without-corresponding-getdashboard-events/46722/3 "2025-06-02T15:31:34Z")
Hi Duncan - these are exclusively DirectQuery datasets. The users have no permissions to modify or refresh the underlying datasets anyways. The QueryDatabase logs are exactly how I would expect them to be if a user accessed a Dashboard using a DirectQuery dataset (kicking off the query) - but no corresponding GetDashboard event. ---
**Author:** ![WLS-D](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/wls-d/32/36109_2.png) [@WLS-D](https://community.amazonquick.com/u/WLS-D)\ **Post date:** [June 5, 2025, 2:56pm UTC](https://community.amazonquick.com/t/why-does-cloudtrail-show-querydatabase-events-for-quicksight-users-without-corresponding-getdashboard-events/46722/4 "2025-06-05T14:56:20Z")
Hey @Dave_LeBlanc Got it, thank you for clarifying! I’m curious if maybe the users are just returning to sessions. For example, they left the dashboards open in their browser and then later on came back, refreshed the page and continued using the dashboard. In that case maybe there is only a `QueryDatabase` log and not `GetDashboard`. ---
**Author:** ![Koushik\_Muthanna](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/koushik_muthanna/32/3290_2.png) [@Koushik\_Muthanna](https://community.amazonquick.com/u/Koushik_Muthanna)\ **Post date:** [June 10, 2025, 8:42am UTC](https://community.amazonquick.com/t/why-does-cloudtrail-show-querydatabase-events-for-quicksight-users-without-corresponding-getdashboard-events/46722/5 "2025-06-10T08:42:24Z")
@Dave_LeBlanc If the dashboards have filters, refreshing them can trigger a QueryDatabase as well , here is an example ```auto "eventTime": "2025-06-10T08:10:17Z", "eventSource": "quicksight.amazonaws.com", "eventName": "QueryDatabase", "awsRegion": "eu-central-1", "requestParameters": null, "responseElements": null, "eventID": "a1e808c6-a30d-4260-9a6a-b1c68e77227b", "readOnly": true, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "XXX", "serviceEventDetails": { "eventRequestDetails": { "dataSourceId": "arn:aws:quicksight:eu-central-1:XXXX:datasource/a6daac79-a4ca-401f-b740-27db623756b8", "databaseType": "ATHENA", "queryId": "b43443da-a26f-40ec-b1db-1a33216b3389", "dataSetId": "arn:aws:quicksight:eu-central-1:XXXX:dataset/a1895289-e114-49f1-9e57-3fcd1a3c9df6", "dataSetMode": "Query" } }, ``` Now the queryId is part of the select Query in Athena . A difference to note is that this just contains the Query ID ![Screenshot 2025-06-10 at 10.29.12](https://d1wl4jav5dp96l.cloudfront.net/optimized/3X/3/e/3ea6276e20dab59b692a19df1620dece9a108d0d_2_690x31.png) Whereas for a dashboard itself, the sql Query has additional details entityid here is 53888cf6-5337-4139-ace7-d36360b7aa62 which is the actual dashboard id ![Screenshot 2025-06-10 at 10.32.47](https://d1wl4jav5dp96l.cloudfront.net/optimized/3X/f/0/f0b687331828874327320e24a119b0a38967f4ad_2_690x20.png) ---
**Author:** ![Dave\_LeBlanc](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/dave_leblanc/32/36851_2.png) [@Dave\_LeBlanc](https://community.amazonquick.com/u/Dave_LeBlanc)\ **Post date:** [June 11, 2025, 1:30pm UTC](https://community.amazonquick.com/t/why-does-cloudtrail-show-querydatabase-events-for-quicksight-users-without-corresponding-getdashboard-events/46722/6 "2025-06-11T13:30:21Z")
Hi Koushik - and thanks for clarifying the QueryDatabase behavior. I’m still left wondering about pure SPICE dashboards: 1. **Do SPICE-backed dashboards ever generate a GetDashboard or GetAnalysis** (even if no DirectQuery is involved)? 2. If not, is there **any CloudTrail event** we can rely on to know that a user actually opened/viewed a SPICE dashboard? 3. Does AWS maintain an **official mapping of Quick Sight API calls → CloudTrail events** (and conditions) so we can be sure we’re not missing anything? From an enterprise compliance standpoint, not being able to track SPICE loads is a potential audit gap - any guidance on workarounds or plans to surface those events would be hugely appreciated. ---
**Author:** ![Koushik\_Muthanna](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/koushik_muthanna/32/3290_2.png) [@Koushik\_Muthanna](https://community.amazonquick.com/u/Koushik_Muthanna)\ **Post date:** [June 11, 2025, 9:17pm UTC](https://community.amazonquick.com/t/why-does-cloudtrail-show-querydatabase-events-for-quicksight-users-without-corresponding-getdashboard-events/46722/7 "2025-06-11T21:17:25Z")
@Dave_LeBlanc , The following are tracked : [Tracking non-API events by using CloudTrail logs - Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/logging-non-api.html) . 1. **Do SPICE-backed dashboards ever generate a GetDashboard or GetAnalysis** (even if no DirectQuery is involved)? Yes, the event is generated. You can validate this in a few minutes : Open a dashboard which is linked to a SPICE dataset, check Cloudtrail and there will be a GetDashboard event, similar for a GetAnalysis event.