I was trying to audit my user base to find anyone in need of knuckle rapping or public flogging and I was stunned by the apparent number of really bad people. I didn't immediately lose my cool, but it was close. I kept digging and discovered that every time a non-administrator logs in that 27 events are logged for denied actions.
That link thinks such events are from checking permissions and that may very well be true, but it is not what the documentation actually says:
Audit events are generated from:
all files in Splunk's configuration directory $SPLUNK_HOME/etc/*
files are monitored for add/change/delete using the file system change monitor.
system start and stop.
users logging in and out.
adding / removing a new user.
changing a user's information (password, role, etc).
execution of any capability in the system.
capabilities are listed in authorize.conf
So, based on that, audit events are recorded for executions, not checks. If it really is recording checks from logins then that makes it really hard to spot actual denials.