I wonder if the activity of deleting audit events from Splunk cloud will be logged/tracked in Splunk internal logs, e.g. logged as sourcetype of splunk_ui_access. If so, is there an official document that clearly states this? Is there any other evidence that someone deleted audit events?
all the events aren't deleted in Spluk (on premise or cloud) during the retention period until is reached the max dimension of the index: the oldest events are deleted only when they exceed the retention period or the max dimension of the index, if there isn't a coldToFrozenScript that archives them off line.
If you don't see events, check the retention period (usually in Splunk Cloud it's 3 months) and the max dimension of your storage, if you need more storage or more retention you have to buy them.
Thanks for your response! Maybe my question is not clear enough. Sorry about that. My question is that if someone with admin role deletes audit events or some other events, e.g. index=audit | delete, this activity will be logged as an event into index=_internal? In other words, if some deletes events by running the delete command, it can be traced and trackable, correct? Thanks.