Sort out the query to hit the audit log with