Splunk Enterprise uses the _audit index to log and store all user activity and audit-related information. This includes details such as user logins, searches executed, configuration changes, role modifications, and app management actions.

The _audit index is populated by data collected from the Splunkd audit logger and records actions performed through both Splunk Web and the CLI. Each event in this index typically includes fields like user, action, info, search_id, and timestamp, allowing administrators to track activity across all Splunk users and components for security, compliance, and accountability purposes.

The _internal index, by contrast, contains operational logs such as metrics.log and scheduler.log used for system performance and health monitoring. _kvstore stores internal KV Store metadata, and _telemetry is used for optional usage data reporting to Splunk.

The _audit index is thus the authoritative source for user behavior monitoring within Splunk environments and is a key component of compliance and security auditing.

References (Splunk Enterprise Documentation):

• Audit Logs and the _audit Index – Monitoring User Activity

• Splunk Enterprise Security and Compliance: Tracking User Actions

• Splunk Admin Manual – Overview of Internal Indexes (_internal, _audit, _introspection)

• Splunk Audit Logging and User Access Monitoring