In ArchivedLogs\<SERVERNAME>\Engine\Audit\AuditActivity_Engine*.log files, i find the Excel Exports but i don't have a chance to find the appid or something else that gaves me the app and object that was exported.
In ArchivedLogs\<SERVERNAME>\Printing\Audit\AuditActivity_Printing*.log files, i get AppName below but not for the excel exports
if(ObjectName ='&chr(39)&'Not available'&chr(39)&',null(), IF(Service='&chr(39)&'Scheduler'&chr(39)&',subfield(ObjectName,'&chr(39)&chr(124)&chr(39)&',2), IF(Service='&chr(39)&'Printing'&chr(39)&' and Index(Command,'&chr(39)&'Export'&chr(39)&'),subfield(ObjectName,'&chr(39)&chr(124)&chr(39)&',-1), IF(right(Command,3)='&chr(39)&'app'&chr(39)&' OR Context like '&chr(39)&chr(42)&'/app/'&chr(42)& chr(39)&',ObjectName)) )) AS [App Name]
