index="REPLACE_WITH_AUDIT_INDEX" sourcetype="REPLACE_WITH_AUDIT_SOURCETYPE" earliest=1790208000 latest=1790467200
| where app_id="REPLACE_WITH_EXACT_APP_ID" AND tenant_id="REPLACE_WITH_EXACT_TENANT_ID"
| where exchange_id="REPLACE_WITH_REVIEWED_EXCHANGE_ID"
| where action IN ("requested", "reserved", "submitted", "accepted", "completed", "cancelled", "reversed", "expired")
| sort 500 + _time
| table _time app_id tenant_id exchange_id partner_id event_id action result point_type amount direction