Browse topics · Administration

Administration

Export audit history

Save matching audit events as JSON or CSV and understand the 500-event limit.

Global administrators can export matching recorded events from Admin → Audit as JSON or CSV.

Save an export

  1. Open Audit and set the search or apply a saved filter.
  2. Choose the column sort and direction you want.
  3. Check the effective search beneath the Audit heading.
  4. Select JSON or CSV.
  5. Wait for Exporting... to finish and complete your device's save or share prompt when shown.
  6. Open the saved file and check its events before sharing it.

The web app uses your browser's download handling. The desktop app offers a save dialog; the mobile app offers a share sheet. Canceling that device prompt does not save a file.

Understand the export limit

Each export fetches up to 500 matching events in the current sort order. It starts from the beginning of those results, independently of the batches you have loaded in the table. Loading more rows does not raise the limit or make the next export continue where the last one ended.

New events may arrive between viewing the table and exporting, so the file can differ from the displayed snapshot. A 500-event file may be incomplete. Narrow the search by an actor, action, or target and review the result count. If you need a complete history larger than this limit, request assistance through an authorized support channel; this screen has no export-all control.

Choose a format

  • JSON includes the events, event count, generation time, and applied search, sort, direction, and limit.
  • CSV contains one row per event, including its identifiers, UTC timestamp, actor, action, target, outcome, summary, and additional recorded details. It does not include a separate export-settings summary.

Some additional details are redacted or shortened. The export is not a full copy of all underlying event data. It can still contain names, email addresses, identifiers, and activity descriptions; use an approved storage and sharing location.

Recover from a problem

An empty export can mean no events matched. Recheck the effective search and clear filters correctly before trying again.

If an error appears, correct the connection or access problem and retry the export. If no file appears after a successful request, check your browser's downloads or finish the device's save/share prompt. Creating an export does not change or delete audit events.