PingOne

Running an audit report

You can run reports to see a summary of user events or events for actions performed in the PingOne admin console.

You can find a complete list of events logged in PingOne in Audit Reporting Events in the PingOne API documentation.

Steps

  1. In the PingOne admin console, go to Monitoring > Audit and enter the report parameters.

    A screen capture of the Audit Parameters section without any selections made.

    • Time Range: Limit the report results to a specified range of time.

      Data up to 14 days old relative to the current date is available immediately. Data older than 14 days must be requested from the Audit page or using the API, and you can’t request data for dates that are more than 2 years (730 days) before the current date. You can run reports a maximum of 14 days at a time. If you enter an invalid time range, you’re prompted to adjust it before you run the report.

    • Filter type: Limit the results to a particular type, user, or resource.

    • Selected fields: Specify which columns appear in the results list.

    • Time zone: Specify the time zone to use in the results list. The timestamp shows the date and time for the selected time zone.

    • Secondary Filter Type: Specify a secondary filter to limit the results to a particular type, user, or resource. You must specify a primary filter type before you can select a secondary filter type.

  2. Click Run.

Result

The information displayed depends on the date range for which you requested data:

Within the 14-day window for immediate availability

For example, on September 30, 2025, you enter a relative time range of 2 weeks, or a specific date range of 2025-09-22 to 2025-09-29.

Full results are displayed.

p1 audit report results

Outside of the 14-day window for immediate availability

For example, on September 30, 2025, you enter a specific date range of 2025-09-09 to 2025-09-16.

The Run Report modal is displayed explaining that the requested data isn’t immediately available and must be retrieved. The requested dates are displayed in the modal. Select the checkbox next to Retrieve Event data from date1 to date2 (UTC) and then click Run Report.

If you have a valid email address in PingOne, you’ll be notified when the data is ready. After the data is retrieved, you can return to the Audit page and run reports against it for 14 days from the retrieval date.

A sample of the Run Report modal when all requested dates require retrieval

Includes both dates for which data is immediately available and dates for which data must be retrieved

For example, on October 21, 2025 you enter a specific date range with a start date of 2025-09-28 and an end date of 2025-10-10. This range includes 10 days of data that must be retrieved (2025-09-28 to 2025-10-07) and 3 days of immediately available data (2025-10-08 to 2025-10-10).

The Run Report modal is displayed, and you must confirm that you want to retrieve the data for the dates that aren’t immediately available. Select the checkbox next to Retrieve Event data from date1 to date2 (UTC) and then click Run Report.

A sample of the Run Report modal when some requested dates require retrieval but others are available immediately

The results for the dates that are immediately available are displayed, and the data for older dates is requested. If you have a valid email address in PingOne, you’ll be notified when the additional data is ready for reporting, and at that point you can run the report again.

A sample audit report showing immediate results and dates for data that was requested

  • The Available Dates (UTC) section lists the dates for the data that’s available to query or has been requested.

  • Depending on the number of days requested and the average number of events logged per day, the process can take from 2 to 24 hours. You can request a maximum of 14 days of data from within the data retention period and you can’t request additional data while another request is pending.

    If you have a valid email address in PingOne, you’ll be notified when the requested data is available. At that point, you can return to the Audit page and run queries against the data for the timeframe requested. The retrieved data is available for 14 days from the date of the retrieval request.

Next steps

  • To rearrange the columns in the report summary, drag the column heading to the desired position.

  • To view the details of an event, click View in the Details column.

  • To export your results to a CSV file, click Export.