Hi unfortunately (at least I don't know) that there is separate endpoints to get splunk audit logs. But you could get those by using search endpoint. https://docs.splunk.com/Documentation/Splunk/9.1.2/RESTREF/RESTsearch Just create some saved searches which give you needed information and then call those or use ad hoc queries over REST api. r. Ismo ... View more

If you want to search the splunk internal audit events, use the _audit index index=_audit ref: https://docs.splunk.com/Documentation/Splunk/9.1.2/Security/AuditSplunkactivity If you would like to fetch this information using the API, you can run a Splunk search by configuring a splunk-authenticated user with permission to read the _audit index, generating them a token, then using the REST API to dispatch a search and return the results. Ref: https://docs.splunk.com/Documentation/Splunk/9.1.2/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2Fexport specifically the /search/v2/jobs/export endpoint, including your authorization token and the splunk search to list the audit events.   ... View more

any suggestions on this? ... View more

No, there is not a common userbase for all Splunk products. There is no API request specific to audit logs.  Submit an API request to search the _audit index for the desired information. ... View more