Audit parameters

Use audit parameters to specify the details of your search results.

Time Range

Data up to 14 days old relative to the current date is available immediately. Data older than 14 days must be requested from the Audit page or using the API, and you can’t request data for dates that are more than 2 years (730 days) before the current date.

Depending on the number of days requested and the average number of events logged per day, the retrieval process can take from 2 to 24 hours. You can request a maximum of 14 days of data from within the data retention period, and you can’t request additional data while another request is pending.

If you have a valid email address in PingOne, you’ll be notified when the requested data is available. At that point, you can return to the Audit page and run queries against the data for the timeframe requested. The retrieved data is available for 14 days from the date of the retrieval request.

Relative: A time range relative to the current time. Under Within, select a number and a time period. For example, 2 weeks.
Specific Date: A time range with a specified start and end date, such as “March 27 to April 10.” Optionally, you can specify the time of day using the Hour and Minute fields for the start and end dates.

If you enter a time range further than 2 years (730 days) from the current date, you’re prompted to adjust the time range before submitting the request.

Filter Type

Limit the search results based on the specified parameters.

Resource ID: Find activities by resource ID.
Correlation ID: Find activities by correlation ID. When an HTTP request is received, it’s assigned a correlation ID. You can use the correlation ID to associate HTTP responses with messages in the event log.
Event Type: Find activities by event type. Select an event type from the list. You can find a complete list of events logged in PingOne in Audit Reporting Events in the PingOne API documentation.
User ID (Actor): Find activities that were performed by a particular user, by user ID.
User Name (Actor): Find activities that were performed by a particular user, by user name.
Client (Actor): Find activities that were performed by a particular client. Select a client from the Filter list. The list of clients varies depending on your configuration.
Resource Population: Find activities that were performed in resources within a particular population. Select a population from the list.
Resource Type: Find activities that were performed on a particular type of resource. Select a resource from the list.
Population: Find activities that were performed on a particular population.
User: Find activities that were performed on a particular user.
Application: Find activities that were performed by a particular client application.

Selected Fields

Specify which fields appear in the results list.

Timestamp: The date and time of the event. The format is: MM/DD/YYYY hh:mm:ss.
Event Name: A unique identifier for the event.
Description: A brief description of the event.
Client: The client that performed the event.
User Identity: The user for which the event was performed.
Population: The population for which the event was performed.
Resource Type: The type of resource for which the event was performed.

Secondary Filter Type

Specify a secondary filter for your results.

You must specify a primary filter type before you can select a secondary filter type. The Secondary Filter Type list contains all of the filter types that you didn’t select as your primary filter.