Consider this search result:

Figure: audit log results

When I click on “Details” (or double click), I can see :

Figure: audit log results detail panel

This is terribly misleading ! The source is displayed as “/Shared Documents/xxx”, which I assumed being “sswcom.sharepoint.com/Shared Documents/xxx”, but is in fact “sswcom.sharepoint.com/sites/SSWNetworkAdmins/Shared Documents/xxx”. The displayed path is indeed relative, but relative to the site collection, not the whole tenant. Which is misleading in a “unified” log (where results can come from pretty much any site collection).

Suggestion: I would love to have options to:

1. See the source Site Collection
2. Filter down & sort by Site Collection