I wish to find out who created a particular column in a SharePoint Online document library, and auditing is enabled. When looking at a 'content type and list modification' report of the affected library, I can see a wealth of details on when something was changed - including who and when.
The only thing I can't seem to determine is what occurred during each event in the audit report - that is, I cannot find who created a particular field. When looking at the Event Data column in the audit report, every row appears exactly the same, except for the Office Online version number at the start of the value (e.g. "18.104.22.16826.0.0").
What am I missing here? Am I reading this report right?
Thanks in advance for any insights.