Since the amount of audit data recorded can be extremely large, it is important to make effective use of the available indexes to efficiently query and report on the data. Note that the indexes can be disabled on the operational database for performance reasons.

The indexed fields on the _aud-audit-data main table are as shown in the following table (assuming indexes are enabled).

Table 1. _aud-audit-data main table indexed fields
Index name Flags Field Description
_Data-guid primary unique _Audit-data-guid Primary unique index. Joins the child table _Aud-daudit-data- value that holds the modified fields old and new values. This index is always active.
_Connection-id – _Database-connection-id _Client-session-uuid Queries audit data by database connection, and further within a database connection by client session.
_Userid – _User-id Queries audit data by the real application user who created the audit data.
_Event-group – _Audit-event-group _Db-guid _Transaction-id _Transaction-sequence Queries data by some logical group (for example, business entity, task, workflow) and then within that to sequence the data by database transaction ID and sequence (that is, the order in which the data was created within the group or database transaction). Note that the use of groups is optional.
_EventId – _Event-id Queries audit data by audit event ID; event IDs between the range 5000 to 5099 represent schema change events.
_Audit-time – _Audit-date-time Queries audit data by date and time it was created (plus time zone). This index is always active.
_Event-context – _Event-context Locates audit data for a specific record or thing. For database events, this would contain a delimited list of identifying field values to identify the originating record, such as a customer number.
_AppContext-Id – _Application-context-id Queries audit data that occurred within the bounds of a particular application context, such as what audit data was generated by an object (procedure).

The indexed fields on the _aud-audit-data-value child table are listed in the following table:

Table 2. _aud-audit-data value child table indexed fields
Index name Flags Fields Description
_Continuation-seq Pu _Audit-data-guid _Field-name _Continuation-sequence The primary unique index for the table; used when joining from the parent _Aud-audit-data table to determine the modified fields for a particular audit data entry.
_Field-name – _Field-name Facilitates querying audit data for changes to a specific field.

Note that the indexes can be deactivated for performance in the short-term operational (application) database where audit events are being captured. Note also that not all of the indexes are deactivated: the _Data-guid and the _Audit-time indexes are always active, as these are required by the utilities in all cases.