How to get user audit log for Splunk Observability O11Y via UI or API

Applicability

Description

Splunk Observability Cloud (Splunk Infrastructure Monitoring) does not currently provide self-service access to audit logs detailing user activity such as logins, account changes, or access to specific areas.

Resolution

There is no self-service feature in the Splunk Observability Cloud platform to extract or review full audit logs of user activity.

Splunk Observability Cloud does not currently offer a self-service feature for administrators to directly access or export detailed user activity audit logs. 

Splunk understand this is important for operational oversight and compliance needs, and I apologize for any inconvenience this may cause. There is already an active feature request for this capability, which you can track and support here:

Splunk IDEA - User Activity & Login Audit Dashboard on Splunk Observability 

Upvote on this Splunk IDEA would rank it up and highlighting the importance of this feature to get Product Management visibility.

Contact Splunk Support for to ask about the user activity and provide specific details about the information needed, such as:

• The timeframe for the investigation.
• The specific users or teams involved.
• The types of activities you wish to audit (e.g., role changes, dashboard deletions).

Depending on the data, the Splunk Support team may be able to query backend systems and check if can provide requested data.