audit
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
Contents
audit
Synopsis
Returns audit trail information that is stored in the local audit index.
Syntax
audit
Description
View audit trail information stored in the local audit index. Also decrypt signed audit events while checking for gaps and tampering.
Examples
Example 1: View information in the "audit" index.
index="_audit" | audit