--- title: Running an audit report description: Run reports to see a summary of actions performed in the PingOne admin console. component: pingone page_id: pingone:monitoring:p1_running_audit_report canonical_url: https://docs.pingidentity.com/pingone/monitoring/p1_running_audit_report.html revdate: May 22, 2024 section_ids: steps: Steps result: Result next-steps: Next steps --- # Running an audit report You can run reports to see a summary of user events or events for actions performed in the PingOne admin console. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | You can find a complete list of events logged in PingOne in [Audit Reporting Events](https://developer.pingidentity.com/pingone-api/platform/reference/audit-reporting-events.html) in the PingOne API documentation. | ## Steps 1. In the PingOne admin console, go to **Monitoring > Audit** and enter the report parameters. ![A screen capture of the Audit Parameters section without any selections made.](_images/p1-monitoring-audit-params.png) * **Time Range**: Limit the report results to a specified range of time. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Data up to 14 days old relative to the current date is available immediately. Data older than 14 days must be requested from the **Audit** page or using the API, and you can't request data for dates that are more than 2 years (730 days) before the current date. You can run reports a maximum of 14 days at a time. If you enter an invalid time range, you're prompted to adjust it before you run the report. | * **Filter type**: Limit the results to a particular type, user, or resource. * **Selected fields**: Specify which columns appear in the results list. * **Time zone**: Specify the time zone to use in the results list. The timestamp shows the date and time for the selected time zone. * **Secondary Filter Type**: Specify a secondary filter to limit the results to a particular type, user, or resource. You must specify a primary filter type before you can select a secondary filter type. 2. Click **Run**. ## Result The information displayed depends on the date range for which you requested data: * Within the 14-day window for immediate availability For example, on September 30, 2025, you enter a relative time range of 2 weeks, or a specific date range of `2025-09-22` to `2025-09-29`. Full results are displayed. ![p1 audit report results](_images/p1-audit-report-results.png) * Outside of the 14-day window for immediate availability For example, on September 30, 2025, you enter a specific date range of `2025-09-09` to `2025-09-16`. The **Run Report** modal is displayed explaining that the requested data isn't immediately available and must be retrieved. The requested dates are displayed in the modal. Select the checkbox next to **Retrieve Event data from** `date1` **to** `date2` **(UTC)** and then click **Run Report**. If you have a valid email address in PingOne, you'll be notified when the data is ready. After the data is retrieved, you can return to the **Audit** page and run reports against it for 14 days from the retrieval date. ![A sample of the Run Report modal when all requested dates require retrieval](_images/p1-audit-retrieval-modal.png) * Includes both dates for which data is immediately available and dates for which data must be retrieved For example, on October 21, 2025 you enter a specific date range with a start date of `2025-09-28` and an end date of `2025-10-10`. This range includes 10 days of data that must be retrieved (2025-09-28 to 2025-10-07) and 3 days of immediately available data (2025-10-08 to 2025-10-10). The **Run Report** modal is displayed, and you must confirm that you want to retrieve the data for the dates that aren't immediately available. Select the checkbox next to **Retrieve Event data from** `date1` **to** `date2` **(UTC)** and then click **Run Report**. ![A sample of the Run Report modal when some requested dates require retrieval but others are available immediately](_images/p1-audit-retrieval-modal-mixed-dates.png) The results for the dates that are immediately available are displayed, and the data for older dates is requested. If you have a valid email address in PingOne, you'll be notified when the additional data is ready for reporting, and at that point you can run the report again. ![A sample audit report showing immediate results and dates for data that was requested](_images/p1-audit-report-mixed-dates.png) | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | - The **Available Dates (UTC)** section lists the dates for the data that's available to query or has been requested. - Depending on the number of days requested and the average number of events logged per day, the process can take from 2 to 24 hours. You can request a maximum of 14 days of data from within the data retention period and you can't request additional data while another request is pending. If you have a valid email address in PingOne, you'll be notified when the requested data is available. At that point, you can return to the **Audit** page and run queries against the data for the timeframe requested. The retrieved data is available for 14 days from the date of the retrieval request. | ## Next steps * To rearrange the columns in the report summary, drag the column heading to the desired position. * To view the details of an event, click **View** in the **Details** column. * To export your results to a CSV file, click **Export**.