Splunk Enterprise security Audit logs API

[Chandrashekharg]

How can we fetch the events performed by users in Splunk Enterprise security product from API's?

[marnall]

If you want to search the splunk internal audit events, use the _audit index
index=_audit

ref: https://docs.splunk.com/Documentation/Splunk/9.1.2/Security/AuditSplunkactivity

If you would like to fetch this information using the API, you can run a Splunk search by configuring a splunk-authenticated user with permission to read the _audit index, generating them a token, then using the REST API to dispatch a search and return the results.

Ref: https://docs.splunk.com/Documentation/Splunk/9.1.2/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2Fexport

specifically the /search/v2/jobs/export endpoint, including your authorization token and the splunk search to list the audit events.