Search Reference

audit

Description

Returns audit trail information that is stored in the local audit index. This command also validates signed audit events while checking for gaps and tampering.

Syntax

audit

Examples

Example 1: View information in the "audit" index.

index="_audit" | audit

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the audit command.