If you want to search the splunk internal audit events, use the _audit index
index=_audit
ref: https://docs.splunk.com/Documentation/Splunk/9.1.2/Security/AuditSplunkactivity
If you would like to fetch this information using the API, you can run a Splunk search by configuring a splunk-authenticated user with permission to read the _audit index, generating them a token, then using the REST API to dispatch a search and return the results.
Ref: https://docs.splunk.com/Documentation/Splunk/9.1.2/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2Fexport
specifically the /search/v2/jobs/export endpoint, including your authorization token and the splunk search to list the audit events.
