You do not store query returns in your audit log it’s not only a nightmare from performance and storage standpoint but it’s also disallowed by the same GRC requ

You do not store query returns in your audit log it’s not only a nightmare from performance and storage standpoint but it’s also disallowed by the same GRC requirements you are touting. The last thing you want is PII or other regulated date sitting in splunk in fact each large organization that handles such data will have systems to ensure that this does not happen as the regulatory requirement is simple - do not log sensitive data there are tons of both client side and server side plugins and tools for common logging frameworks and log aggregators that search and delete sensitive data or sanitize it before it being logged completely and usually you run a combination of both. On the storage/performance side since you need to keep access logs sometimes for years if you store query results you’ll need storage 1000’s and 1000’s of times the size of your DB to store those logs this isn’t feasible. What you log is often the query how many result did it return the user and or app that run the query.