--- title: Audit parameters description: Use a combination of audit parameters to generate an auditing report in PingOne. component: pingone page_id: pingone:monitoring:p1_auditparameters canonical_url: https://docs.pingidentity.com/pingone/monitoring/p1_auditparameters.html revdate: May 3, 2024 page_aliases: ["p1_event_types.adoc"] section_ids: time-range: Time Range filter-type: Filter Type selected-fields: Selected Fields secondary-filter-type: Secondary Filter Type --- # Audit parameters Use audit parameters to specify the details of your search results. ## Time Range | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | Data up to 14 days old relative to the current date is available immediately. Data older than 14 days must be requested from the **Audit** page or using the API, and you can't request data for dates that are more than 2 years (730 days) before the current date.Depending on the number of days requested and the average number of events logged per day, the retrieval process can take from 2 to 24 hours. You can request a maximum of 14 days of data from within the data retention period, and you can't request additional data while another request is pending.If you have a valid email address in PingOne, you'll be notified when the requested data is available. At that point, you can return to the **Audit** page and run queries against the data for the timeframe requested. The retrieved data is available for 14 days from the date of the retrieval request. | * **Relative** A time range relative to the current time. Under **Within**, select a number and a time period. For example, **2** **weeks**. * **Specific Date** A time range with a specified start and end date, such as "March 27 to April 10." Optionally, you can specify the time of day using the **Hour** and **Minute** fields for the start and end dates. | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | | If you enter a time range further than 2 years (730 days) from the current date, you're prompted to adjust the time range before submitting the request. | ## Filter Type Limit the search results based on the specified parameters. * **Resource ID** Find activities by resource ID. * **Correlation ID** Find activities by correlation ID. When an HTTP request is received, it's assigned a correlation ID. You can use the correlation ID to associate HTTP responses with messages in the event log. * **Event Type** Find activities by event type. Select an event type from the list. You can find a complete list of events logged in PingOne in [Audit Reporting Events](https://developer.pingidentity.com/pingone-api/platform/reference/audit-reporting-events.html) in the PingOne API documentation. * **User ID (Actor)** Find activities that were performed by a particular user, by user ID. * **User Name (Actor)** Find activities that were performed by a particular user, by user name. * **Client (Actor)** Find activities that were performed by a particular client. Select a client from the **Filter** list. The list of clients varies depending on your configuration. * **Resource Population** Find activities that were performed in resources within a particular population. Select a population from the list. * **Resource Type** Find activities that were performed on a particular type of resource. Select a resource from the list. * **Population** Find activities that were performed on a particular population. * **User** Find activities that were performed on a particular user. * **Application** Find activities that were performed by a particular client application. ## Selected Fields Specify which fields appear in the results list. * **Timestamp** The date and time of the event. The format is: MM/DD/YYYY hh:mm:ss. * **Event Name** A unique identifier for the event. * **Description** A brief description of the event. * **Client** The client that performed the event. * **User Identity** The user for which the event was performed. * **Population** The population for which the event was performed. * **Resource Type** The type of resource for which the event was performed. ## Secondary Filter Type Specify a secondary filter for your results. | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | You must specify a primary filter type before you can select a secondary filter type. The **Secondary Filter Type** list contains all of the filter types that you didn't select as your primary filter. |