Consider this search result:

Figure: audit log results
When I click on “Details” (or double click), I can see :

Figure: audit log results detail panel
This is terribly misleading ! The source is displayed as “/Shared Documents/xxx”, which I assumed being “sswcom.sharepoint.com/Shared Documents/xxx”, but is in fact “sswcom.sharepoint.com/sites/SSWNetworkAdmins/Shared Documents/xxx”. The displayed path is indeed relative, but relative to the site collection, not the whole tenant. Which is misleading in a “unified” log (where results can come from pretty much any site collection).
Suggestion: I would love to have options to:
- See the source Site Collection
- Filter down & sort by Site Collection