'Content Type and List Modification' Audit not showing who created a field

Question

I wish to find out who created a particular column in a SharePoint Online document library, and auditing is enabled. When looking at a 'content type and list modification' report of the affected library, I can see a wealth of details on when something was changed - including who and when.

The only thing I can't seem to determine is what occurred during each event in the audit report - that is, I cannot find who created a particular field. When looking at the Event Data column in the audit report, every row appears exactly the same, except for the Office Online version number at the start of the value (e.g. "16.0.0.9026.0.0").

What am I missing here? Am I reading this report right?

Thanks in advance for any insights.

Answer 1

The OOB content type and list modification report will not give which column is created/changed by the user, it will only give the user who edit column in lists.

To get more detailed information about the column event, I recommend you use Audit log search in Office 365 Security & Compliance.