This documentation does not apply to the most recent version of Splunk Cloud Platform™.
For documentation on the most recent version, go to the latest release.
audit
| This feature is deprecated. |
|---|
The audit command is deprecated and disabled in Splunk Cloud Platform version 8.2.2203 and Splunk Enterprise version 9.0.0. It will be removed in a future version. See the Release Notes.
|
Description
Returns audit trail information that is stored in the local audit index. This command also validates signed audit events while checking for gaps and tampering.
Syntax
audit
Examples
Example 1: View information in the "audit" index.
index="_audit" | audit
Last modified on 10 November, 2022
| associate | autoregress |
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209
Download manual
Feedback submitted, thanks!