We enabled a few audit events earlier today and still do not see any activity for these events in audit trail.
For example, we enabled Failure on Session events (to log failed log on attempts) and also Search events. After that, I waited a few minutes and then logged out and attempted to log back in with the wrong password a few times. I also performed various searches. Even now, I can run an audit trail report for all Session events and see new successful log on events, but no failed events. I also do not see any data at all when looking for Search events.
I've made sure the report filters would allow me to capture such events (looking for all users, data range is correct, etc).
How much delay should we expect before new audit event data starts populating?